backupninja.conf

title: backupninja.conf(5)

text:
# backupninja.conf(5)

## NAME
BACKUPNINJA.CONF - Configuration file(s) for backupninja (1).

## SYNOPSIS
/etc/backupninja.conf

## DESCRIPTION
backupninja.conf is the general configuration file. In this file you can set the log level and change the default directory locations. You can force a different general configuration file with "backupninja -f /path/to/conf".

## OPTIONS
loglevel

How verbose to make the logs.

5 = Debugging messages

4 = Informational messages

3 = Warnings

2 = Errors

1 = Fatal errors

reportprom

Produce prometheus metrics of backup status. Requires `prometheus-node-exporter` to be installed.

reportemail

Send a summary of the backup status to this email address.

reportsuccess

If set to 'yes', a report email will be generated even if all modules reported success.

reportinfo

If set to 'yes', info messages from handlers will be sent into the email.

reportwarning

If set to 'yes', a report email will be generated even if there was no error.

reportspace

If set to 'yes', disk space usage will be included in the backup email report.

reporthost

Where to rsync the backupninja.log to be aggregated in a ninjareport.

reportuser

What user to connect to reporthost to sync the backupninja.log

reportdirectory

Where on the reporthost should the report go.

reportwrap

Number of columns the email report body should wrap to.

logfile

The path of the logfile.

configdirectory

The directory where all the backup action configuration files live.

admingroup

Administration user group that is allowed to read/write configuration files in configdirectory.

scriptdirectory

Where backupninja handler scripts are found.

usecolors

If set to 'yes', use colors in the log file and debug output.

when

When to process each configuration file. The value used here will be applied for each configuration file. It is possible to override this "when" in each configuration file, see also section "Scheduling" in backup.d(5). For example:

when = sundays at 02:00

when = 30th at 22

when = 30 at 22:00

when = everyday at 01 <-- the default

when = Tuesday at 05:00

These values for 'when' are equivalent:

when = tuesday at 05:30

when = TUESDAYS at 05

These values for 'when' are invalid:

when = tuesday at 2am

when = tuesday at 2

when = tues at 02

## DEFAULTS
loglevel = 4

reportemail = root

reportsuccess = yes

reportinfo = no

reportspace = no

reporthost =

reportuser = ninja

reportdirectory = /var/lib/backupninja/reports

reportwrap = 1000

logfile = /var/log/backupninja.log

configdirectory = /etc/backup.d

admingroup = root

scriptdirectory = /usr/share/backupninja

usecolors = yes

when = everyday at 01:00

## SEE ALSO
backupninja(1), ninjahelper(1), backup.d(5),

## AUTHOR
BACKUPNINJA was written by the riseup.net collective.


barman

package: barman

title: barman(5)

summary: Barman Configurations

text:
# barman(5)

## NAME
barman - Barman Configurations

Barman follows a convention over configuration approach, which simplifies configuration by allowing some options to be defined globally and overridden at the server level. This means you can set a default behavior for your servers and then customize specific servers as needed. This design reduces the need for excessive configuration while maintaining flexibility.

## USAGE
Proper configuration is critical for its effective operation. Barman uses different types of configuration files to manage global settings, server-specific settings, and model-specific settings that is made up of three scopes:

1. Global Configuration: It comprises one file with a set of configurations for the barman system, such as the main directory, system user, log file, and other general options. Default location is /etc/barman.conf and it can be overridden on a per-user level by ~/.barman.conf or by specifying a .conf file using the -c / --config with the barman command <#commands-barman> directly in the CLI.

Barman searches for its configuration file in a predefined order and uses the first one it finds. The search order is as follows:

- ~/.barman.conf - per-user configuration file.

- /etc/barman.conf - main global configuration file.

- /etc/barman/barman.conf - alternative global configuration file.

2. Server Configuration: It comprises one or more files with a set of configurations for a Postgres server that you want to keep track and interact for backup, recovery and/or replication. Default location is /etc/barman.d and must use the .conf suffix. You may have one or multiple files for servers. You can override the default location by setting the configuration_files_directory option in the global configuration file and placing the files in that particular location.

3. Model Configuration: It comprises one or more files with a set of configuration overrides that can be applied to backups of Postgres servers within the same cluster as the model. These overrides can be implemented using the barman config-switch command. Default location is /etc/barman.d and must use the .conf suffix. The same configuration_files_directory override option from the server configuration applies for models. You may have one or multiple files for models.

Note:

Historically, you could have a single configuration file containing global, server, and model options, but, for maintenance reasons, this approach is deprecated.

Configuration files follow the INI format and consist of sections denoted by headers in square brackets. Each section can include various options.

Models and servers must have unique identifiers, and reserved words cannot be used as names.

Note:

Comment Handling: Only line comments are supported (lines starting with # or ;). Inline comments (# or ; appearing after configuration values on the same line) are not supported and will be parsed as part of the configuration value, which may cause unexpected behavior.

Reserved Words

The following reserved words cannot be used as server or model names:

- barman: Identifies the global section.

- all: A special shortcut for executing commands on all managed servers.

Parameter Types

Configuration options can be of the following types:

- String: Textual data (e.g., file paths, names).

- Enum: Enumerated values, often limited to predefined choices.

- Integer: Numeric values.

- Boolean: Can be on, true, 1 (true) or off, false, 0 (false). Note:

Some enums allow off, but not false.

## OPTIONS
Options in the configuration files can have specific or shared scopes. The following configuration options are used not only for configuring how Barman will execute backups and recoveries, but also for configuring various aspects of how Barman interacts with the configured Postgres servers to be able to apply your Backup and Recovery, and High-Availability strategies.

### General
These are general configurations options.

active

When this option is set to true (default), the server operates fully. If set to false, the server is restricted to diagnostic use only, meaning that operational commands such as backup execution or WAL archiving are temporarily disabled. When incorporating a new server into Barman, we recommend initially setting active = false. Verify that barman check shows no issues before activating the server. This approach helps prevent excessive error logging in Barman during the initial setup.

Scope: Server / Model.

archiver

This option enables log file shipping through Postgres' archive_command for a server. When set to true, Barman expects continuous archiving to be configured and will manage WAL files that Postgres stores in the incoming directory (incoming_wals_directory), including their checks, handling, and compression. When set to false (default), continuous archiving is disabled.

Note:

If neither archiver nor streaming_archiver is configured, Barman will automatically set this option to true to maintain compatibility with the previous default behavior where archiving was enabled by default.

Scope: Global / Server / Model.

archiver_batch_size

This option enables batch processing of WAL files for the archiver process by setting it to a value greater than 0. If not set, the archiver will use unlimited (default) processing mode for the WAL queue. With batch processing enabled, the archiver process will handle a maximum of archiver_batch_size WAL segments per run. This value must be an integer.

Scope: Global / Server / Model.

bandwidth_limit

Specifies the maximum transfer rate in kilobytes per second for backup and recovery operations. A value of 0 indicates no limit (default).

Note:

Applies only when backup_method = postgres | rsync | local-to-cloud.

Scope: Global / Server / Model.

barman_home

Designates the main data directory for Barman. Defaults to /var/lib/barman.

Scope: Global.

barman_lock_directory

Specifies the directory for lock files. The default is barman_home.

Note:

The barman_lock_directory should be on a non-network local filesystem. If using NFS, or any other network filesystem to store the backups and WAL files, make sure that the lock directory lives in a local filesystem.

Scope: Global.

check_timeout

Sets the maximum execution time in seconds for a Barman check command per server. Set to 0 to disable the timeout. Default is 30 seconds. Must be a non-negative integer.

Scope: Global / Server / Model.

cluster

Tag the server or model to an associated cluster name. Barman uses this association to override configuration for all servers/models in this cluster. If omitted for servers, it defaults to the server's name.

Note:

Must be specified for configuration models to group applicable servers.

Scope: Server / Model.

config_changes_queue

Designates the filesystem location for Barman's queue that handles configuration changes requested via the barman config-update command. This queue manages the serialization and retry of configuration change requests. By default, Barman writes to a file named cfg_changes.queue under barman_home.

Scope: Global.

configuration_files_directory

Designates the directory where server/model configuration files will be read by Barman. Defaults to /etc/barman.d/.

Scope: Global.

conninfo

Specifies the connection string used by Barman to connect to the Postgres server. This is a libpq connection string. Commonly used keys include: host, hostaddr, port, dbname, user and password. See the libpq-connstring <https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING> PostgreSQL documentation for details.

Note:

Multi-host connection strings (e.g. host=primary_db,replica_db) and target_session_attrs are not supported. Each connection string must point to a single, specific host.

Scope: Server / Model.

create_slot

Determines whether Barman should automatically create a replication slot if it's not already present for streaming WAL files. When set to auto and slot_name is defined, Barman will attempt to create the slot automatically. When set to manual (default), the replication slot must be created manually.

Scope: Global / Server / Model.

description

Provides a human-readable description of a server.

Scope: Server / Model.

errors_directory

The directory where WAL files that were errored while being archived by Barman are stored. This includes duplicate WAL files (e.g., an archived WAL file that has already been streamed but have different hash) and unexpected files found in the WAL archive directory.

The purpose of placing the files in this directory is so someone can later review why they failed to be archived and take appropriate actions (dispose of, store somewhere else, replace the duplicate file archived before, etc.)

Scope: Server.

encryption

Specifies the encryption method used for encrypting backups and WAL files. Supported values are:

- none (default): No encryption is applied.

- gpg: Uses GPG <#term-GPG> for encryption. Requires GPG <#term-GPG> to be installed and properly configured on the system.

Scope: Global / Server / Model.

encryption_key_id

Specifies the encryption key ID used for encrypting backups and WAL files. This option is required when encryption = gpg and must correspond to a valid GPG <#term-GPG> key ID available on the system.

Scope: Global / Server / Model.

encryption_passphrase_command

Specifies a command used to retrieve the encryption passphrase for decrypting backups and WAL files. The command must write the passphrase to standard output.

Scope: Global / Server / Model.

forward_config_path

Determines whether a passive node should forward its configuration file path to its primary node during cron or sync-info commands. Set to true if Barman is invoked with the -c / --config option and the configuration paths are identical on both passive and primary Barman servers. Defaults to false.

Scope: Global / Server / Model.

immediate_checkpoint

Controls how Postgres handles checkpoints at the start of a backup. Set to false (default) to allow the checkpoint to complete according to checkpoint_completion_target. Set to true for an immediate checkpoint, where Postgres completes the checkpoint as quickly as possible.

Scope: Global / Server / Model.

keepalive_interval

Sets the interval in seconds for sending a heartbeat query to keep the libpq connection active during an rsync backup. Default is 60 seconds. Setting this to 0 disables the heartbeat.

Scope: Global / Server / Model.

lock_directory_cleanup

Enables automatic cleanup of unused lock files in the barman_lock_directory.

Scope: Global.

log_file

Specifies the location of Barman's log file. Defaults to /var/log/barman/barman.log.

Scope: Global.

log_level

Sets the level of logging. Options include: DEBUG, INFO, WARNING, ERROR and CRITICAL.

Scope: Global.

minimum_redundancy

Specifies the minimum number of backups to retain. Default is 0.

Scope: Global / Server / Model.

model

When set to true, turns a server section from a configuration file into a model for a cluster. There is no false option in this case. If you want to simulate a false option, comment out (#model=true) or remove the option in the configuration. Defaults to the server name.

Scope: Model.

network_compression

Enables or disables data compression for network transfers. Set to false (default) to disable compression, or true to enable it and reduce network usage.

Scope: Global / Server / Model.

parallel_jobs

Controls the number of parallel workers used to copy files during backup or recovery. It must be a positive integer. Default is 1.

Note:

Applies only when backup_method = rsync.

Scope: Global / Server / Model.

parallel_jobs_start_batch_period

Specifies the time interval in seconds over which a single batch of parallel jobs will start. Default is 1 second. This means that if parallel_jobs_start_batch_size is 10 and parallel_jobs_start_batch_period is 1, this will yield an effective rate limit of 10 jobs per second, because there is a maximum of 10 jobs that can be started within 1 second.

Note:

Applies only when backup_method = rsync.

Scope: Global / Server / Model.

parallel_jobs_start_batch_size

Defines the maximum number of parallel jobs to start in a single batch. Default is 10 jobs. This means that if parallel_jobs_start_batch_size is 10 and parallel_jobs_start_batch_period is 2, this will yield a maximum of 10 jobs that can be started within 2 seconds.

Note:

Applies only when backup_method = rsync.

Scope: Global / Server / Model.

path_prefix

Lists one or more absolute paths, separated by colons, where Barman looks for executable files such as PostgreSQL binaries (from the appropriate bin directory for the PG_MAJOR_VERSION), rsync, encryption, and compression tools. These paths are prepended to the PATH environment variable and are checked before any others.

Scope: Global / Server / Model.

primary_checkpoint_timeout

Time to wait for new WAL files before forcing a checkpoint on the primary server. Defaults to 0.

Scope: Server / Model.

primary_conninfo

Connection string for Barman to connect to the primary Postgres server during a standby backup.

Note:

Multi-host connection strings are not supported. See conninfo for details.

Scope: Server / Model.

primary_ssh_command

SSH command for connecting to the primary Barman server if Barman is passive.

Scope: Global / Server / Model.

slot_name

Replication slot name for the receive-wal command when streaming_archiver is enabled.

Scope: Global / Server / Model.

ssh_command

SSH command used by Barman to connect to the Postgres server for rsync backups.

Scope: Server / Model.

streaming_archiver

Enables Postgres' streaming protocol for WAL files. Defaults to false.

Note:

If neither archiver nor streaming_archiver is configured, Barman will automatically set archiver option to true to maintain compatibility with the previous default behavior where archiving was enabled by default.

Scope: Global / Server / Model.

streaming_archiver_batch_size

Batch size for processing WAL files in streaming archiver. Defaults to 0.

Scope: Global / Server / Model.

streaming_archiver_name

Application name for the receive-wal command. Defaults to barman_receive_wal.

Scope: Global / Server / Model.

streaming_backup_name

Application name for the pg_basebackup command. Defaults to barman_streaming_backup.

Scope: Global / Server / Model.

streaming_conninfo

Connection string for streaming replication protocol. Defaults to conninfo.

Note:

Multi-host connection strings are not supported. See conninfo for details.

Scope: Server / Model.

tablespace_bandwidth_limit

Maximum transfer rate for specific tablespaces for backup and recovery operations. A value of 0 indicates no limit (default).

Note:

Applies only when backup_method = rsync.

Scope: Global / Server / Model.

### Backups
These configurations options are related to how Barman will execute backups.

autogenerate_manifest

This is a boolean option that allows for the automatic creation of backup manifest files. The manifest file, which is a JSON document, lists all files included in the backup. It is generated upon completion of the backup and saved in the backup directory. The format of the manifest file adheres to the specifications outlined in the backup manifest format <https://www.postgresql.org/docs/current/backup-manifest-format.html> PostgreSQL documentation and is compatible with the pg_verifybackup tool. Default is false.

Note:

This option is ignored if the backup_method is not rsync.

Scope: Global / Server / Model.

backup_compression

Specifies the compression method for the backup process. It can be set to gzip, lz4, zstd, or none. Ensure that the CLI tool for the chosen compression method is available on both the Barman and Postgres servers.

Note:

Note that lz4 and zstd require Postgres version 15 or later. Unsetting this option or using none results in an uncompressed archive (default). Only supported when backup_method = postgres.

Scope: Global / Server / Model.

backup_compression_format

Determines the format pg_basebackup should use when saving compressed backups. Options are plain or tar, with tar as the default if unset. The plain format is available only if Postgres version 15 or later is in use and backup_compression_location is set to server.

Note:

Only supported when backup_method = postgres.

Scope: Global / Server / Model.

backup_compression_level

Defines the level of compression for backups as an integer. The permissible values depend on the compression method specified in backup_compression.

Note:

Only supported when backup_method = postgres.

Scope: Global / Server / Model.

backup_compression_location

Specifies where compression should occur during the backup: either client or server. The server option is available only if Postgres version 15 or later is being used.

Note:

Only supported when backup_method = postgres.

Scope: Global / Server / Model.

backup_compression_workers

Sets the number of threads used for compression during the backup process. This is applicable only when backup_compression=zstd. The default value is 0, which uses the standard compression behavior.

Note:

Only supported when backup_method = postgres.

Scope: Global / Server / Model.

warehousepg_dbid

Specifies the integer identifier for a WarehousePG database. When set, this value is passed to pg_basebackup via the --target-gp-dbid parameter for WarehousePG compatibility. This option is required when backing up WarehousePG segments.

Important:

This option is only relevant for WarehousePG databases and should not be set for standard PostgreSQL databases. Furthermore, Barman does not handle backups and restores for WarehousePG clusters. The orchestration of backup and restore operations for WarehousePG clusters must be managed externally by the user.

Note:

Only supported when backup_method = postgres.

Scope: Global / Server / Model.

backup_directory

Specifies the directory where backup data for a server will be stored. Defaults to <barman_home>/<server_name>.

Scope: Server.

backup_method

Defines the method Barman uses to perform backups. Options include:

- rsync (default): Executes backups using the rsync command over SSH (requires ssh_command).

- postgres: Uses the pg_basebackup command for backups.

- local-rsync: Assumes Barman runs on the same server and as the same user as the Postgres database, performing an rsync file system copy.

- snapshot: Utilizes the API of the cloud provider specified in the snapshot_provider option to create disk snapshots as defined in snapshot_disks and saves only the backup label and metadata to its own storage.

Scope: Global / Server / Model.

backup_options

Controls how Barman interacts with Postgres during backups. This is a comma-separated list that can include:

- concurrent_backup (default): Uses concurrent backup, recommended for Postgres versions 9.6 and later, and supports backups from standby servers.

- exclusive_backup: Uses the deprecated exclusive backup method. Only for Postgres versions older than 15. This option will be removed in the future.

- external_configuration: Suppresses warnings about external configuration files during backup execution.

Note:

exclusive_backup and concurrent_backup cannot be used together.

Scope: Global / Server / Model.

basebackups_directory

Destination for base backup files. It can be a local path if storing backups locally, or a cloud storage URL if streaming backups to the cloud as described in Streaming backups to the cloud <#backup-streaming-backup-cloud>. Defaults to <backup_directory>/base.

Warning:

Changing the value of basebackups_directory on an active server is discouraged. Even if done with care, by deactivating the server, moving existing data to the new location, and reactivating it, there are potential risks of data loss or misconfiguration. Instead, the safe option is to create a new server configuration with the new value for basebackups_directory, perform a new full backup to the new server, and then decommission the old server once the new one is fully operational.

Scope: Server.

basebackup_retry_sleep

Sets the number of seconds to wait after a failed base backup copy before retrying. Default is 30 seconds. Must be a non-negative integer.

Note:

This applies to both backup and recovery operations.

Scope: Global / Server / Model.

basebackup_retry_times

Defines the number of retry attempts for a base backup copy after an error occurs. Default is 0 (no retries). Must be a non-negative integer.

Note:

This applies to both backup and recovery operations.

Scope: Global / Server / Model.

reuse_backup

Controls incremental backup support when using backup_method=rsync by reusing the last available backup. The options are:

- off (default): Standard full backup.

- copy: File-level incremental backup, by reusing the last backup for a server and creating a copy of the unchanged files (just for backup time reduction)

- link: File-level incremental backup, by reusing the last backup for a server and creating a hard link of the unchanged files (for backup space and time reduction)

Note:

This option will be ignored when backup_method=postgres.

Scope: Global / Server / Model.

worm_mode

If set to on, enables support for WORM (Write Once Read Many) storage, allowing Barman to handle backups on immutable storage correctly. Default is off.

Scope: Global / Server / Model.

### Cloud Backups
These configuration options are related to how Barman will execute backups in the cloud.

aws_await_snapshots_timeout

Specifies the duration in seconds to wait for AWS snapshots to be created before a timeout occurs. The default value is 3600 seconds. This must be a positive integer.

Note:

Only supported when backup_method = snapshot and snapshot_provider = aws.

Scope: Global / Server / Model.

aws_profile

The name of the AWS profile to use when authenticating with AWS (e.g. INI section in AWS credentials file).

Note:

Only supported when backup_method = snapshot and snapshot_provider = aws, or when backup_method is postgres or local-to-cloud and basebackups_directory and/or wals_directory point to S3.

Scope: Global / Server / Model.

aws_region

When using backup_method = snapshot, indicates the AWS region where the EC2 VM and storage volumes, as defined by snapshot_instance and snapshot_disks, are located.

When using backup_method = postgres or local-to-cloud pointing to S3, indicates the AWS region where the S3 bucket is located.

Note:

Only supported when backup_method = snapshot and snapshot_provider = aws, or when backup_method is postgres or local-to-cloud and basebackups_directory and/or wals_directory point to S3.

Scope: Global / Server / Model.

aws_check_object_lock

When set to true, Barman will check for S3 Object Lock before attempting to delete base backup files from S3 storage. If an object is locked, the deletion is aborted. Defaults to false.

Note:

Only supported when backup_method is postgres or local-to-cloud, and basebackups_directory points to S3. If enabled with a non-S3 provider, a warning will be logged and no lock checks will be performed.

Scope: Global / Server / Model.

aws_encryption

Specifies the server-side encryption algorithm to use when storing objects in S3. This value is passed to the S3 client for all upload operations to cloud object storage.

Allowed options:

- AES256: Use S3-managed encryption keys (SSE-S3).

- aws:kms: Use AWS Key Management Service encryption keys (SSE-KMS).

If not set, S3's default encryption settings for the bucket will be used.

Note:

Only supported when backup_method is postgres or local-to-cloud, and basebackups_directory and/or wals_directory point to S3.

Scope: Global / Server / Model.

aws_sse_kms_key_id

Specifies the AWS Key Management Service (KMS) key ID to use for server-side encryption of S3 objects. This option is only valid when aws_encryption is set to aws:kms.

Can be specified using the key ID on its own or using the full ARN for the key.

If not set when using aws_encryption = aws:kms, S3 will use the default AWS managed KMS key for S3.

Example:

```
[myserver]
backup_method = local-to-cloud
basebackups_directory = s3://my-bucket/barman/backups
aws_encryption = aws:kms
aws_sse_kms_key_id = arn:aws:kms:us-east-1:123456789012:key/abcd1234-5678-90ab-cdef-EXAMPLEKEY
```

Note:

Only supported when backup_method is postgres or local-to-cloud, and basebackups_directory and/or wals_directory point to S3.

Scope: Global / Server / Model.

aws_read_timeout

Specifies the read timeout in seconds for S3 operations when using cloud storage. This value is passed to the S3 client for all commands that interact with backup data on cloud object storage. If not set, the default boto3 read timeout behavior applies.

This option is useful for advanced and non-standard S3 workflows where the default timeout may not be sufficient.

Note:

Only supported when backup_method is postgres or local-to-cloud, and basebackups_directory and/or wals_directory point to S3.

Scope: Global / Server / Model.

aws_snapshot_lock_mode

The lock mode for the snapshot. This is only valid if snapshot_instance and snapshot_disk are set.

Allowed options:

- compliance.

- governance.

Note:

Only supported when backup_method = snapshot and snapshot_provider = aws.

Scope: Global / Server / Model.

aws_snapshot_lock_duration

The lock duration is the period of time (in days) for which the snapshot is to remain locked, ranging from 1 to 36,500. Set either the lock duration or the expiration date (not both).

Note:

Only supported when backup_method = snapshot and snapshot_provider = aws.

Scope: Global / Server / Model.

aws_snapshot_lock_cool_off_period

The cooling-off period is an optional period of time (in hours) that you can specify when you lock a snapshot in compliance mode, ranging from 1 to 72.

Note:

Only supported when backup_method = snapshot and snapshot_provider = aws.

Scope: Global / Server / Model.

aws_snapshot_lock_expiration_date

The lock duration is determined by an expiration date in the future. It must be at least 1 day after the snapshot creation date and time, using the format YYYY-MM-DDTHH:MM:SS.sssZ. Set either the lock duration or the expiration date (not both).

Note:

Only supported when backup_method = snapshot and snapshot_provider = aws.

Scope: Global / Server / Model.

azure_credential

Specifies the type of Azure credential to use for authentication, either azure-cli, managed-identity or default. If not provided, the default Azure authentication method will be used.

Note:

Only supported when backup_method = snapshot and snapshot_provider = azure.

Scope: Global / Server / Model.

azure_resource_group

Specifies the name of the Azure resource group containing the compute instance and disks defined by snapshot_instance and snapshot_disks.

Note:

Only supported when backup_method = snapshot and snapshot_provider = azure.

Scope: Global / Server / Model.

azure_subscription_id

Identifies the Azure subscription that owns the instance and storage volumes defined by snapshot_instance and snapshot_disks.

Note:

Only supported when backup_method = snapshot and snapshot_provider = azure.

Scope: Global / Server / Model.

cloud_delete_batch_size

Specifies the number of files to delete in a single batch when performing delete operations on cloud storage. This option is relevant for both backup and WAL file deletions. The default value is 1000 for S3, 256 for Azure Blob, and 100 for GCS.

Note:

Only supported when backup_method is postgres or local-to-cloud, and basebackups_directory and/or wals_directory point to cloud storage.

Scope: Global / Server / Model.

cloud_upload_max_archive_size

Specifies the maximum size in bytes for individual archive files during cloud uploads. When uploading backups to cloud storage, Barman splits the backup into multiple archive files if it exceeds this size. The default value is 100Gi.

The accepted format is n{k|Ki|M|Mi|G|Gi|T|Ti} and case-sensitive, where n is an integer greater than zero, with an optional SI or IEC suffix. k stands for kilo with k = 1000, while Ki stands for kilobytes Ki = 1024. The rest of the options have the same reasoning for greater units of measure.

Note:

Only supported when backup_method is postgres or local-to-cloud, and basebackups_directory points to cloud storage.

Scope: Global / Server / Model.

cloud_upload_min_chunk_size

Specifies the minimum size in bytes for individual chunks during multipart uploads to cloud storage. This controls the size of each part when uploading large files to cloud object storage. When not set, defaults to the chunk size of the cloud provider: 5Mi for S3, and 64Ki for Azure Blob. Not applicable for GCS.

The accepted format is n{k|Ki|M|Mi|G|Gi|T|Ti} and case-sensitive, where n is an integer greater than zero, with an optional SI or IEC suffix. k stands for kilo with k = 1000, while Ki stands for kilobytes Ki = 1024. The rest of the options have the same reasoning for greater units of measure.

Note:

Only supported when backup_method is postgres or local-to-cloud, and basebackups_directory points to cloud storage.

cloud_staging_directory

A staging directory for when sending backups to a cloud object storage using backup_method = postgres. It is used as a temporary location for storing chunks of the backup before they are sent to the cloud. Defaults to /tmp/barman/cloud-staging.

Scope: Global / Server / Model.

cloud_staging_max_size

The maximum size that cloud_staging_directory can grow to before Barman stops generating new backup chunks. This is used to prevent the staging directory from growing in case the speed of uploading chunks does not keep up with the speed of streaming them from Postgres. The default value is 30Gi.

Extremely low values are discouraged as they may lead to performance degradation. We recommend a minimum of at least 10Gi. The optimal value will depend on the transfer speed of the backup to Barman and from Barman to the cloud, as well as the size of the backup.

The accepted format is n{k|Ki|M|Mi|G|Gi|T|Ti} and case-sensitive, where n is an integer greater than zero, with an optional SI or IEC suffix. k stands for kilo with k = 1000, while Ki stands for kilobytes Ki = 1024. The rest of the options have the same reasoning for greater units of measure.

Scope: Global / Server / Model.

gcp_project

Specifies the ID of the GCP project that owns the instance and storage volumes defined by snapshot_instance and snapshot_disks.

Note:

Only supported when backup_method = snapshot and snapshot_provider = gcp.

Scope: Global / Server / Model.

gcp_zone

Indicates the availability zone where the compute instance and disks are located for snapshot backups.

Note:

Only supported when backup_method = snapshot and snapshot_provider = gcp.

Scope: Server / Model.

snapshot_disks

This option is a comma-separated list of disks to include in cloud snapshot backups.

Note:

Required when backup_method = snapshot. Ensure that the snapshot_disks list includes all disks that store Postgres data, as any data not on these listed disks will not be included in the backup and will be unavailable during recovery.

Scope: Server / Model.

snapshot_instance

The name of the VM or compute instance where the storage volumes are attached.

Note:

Required when backup_method = snapshot.

Scope: Server / Model.

snapshot_provider

The name of the cloud provider to use for creating snapshots. Supported value: aws, azure and gcp.

Note:

Required when backup_method = snapshot.

Scope: Global / Server / Model.

### Hook Scripts
These configuration options are related to the pre or post execution of hook scripts.

post_archive_retry_script

Specifies a hook script to run after a WAL file is archived. Barman will retry this script until it returns SUCCESS (0), ABORT_CONTINUE (62), or ABORT_STOP (63). In a post-archive scenario, ABORT_STOP has the same effect as ABORT_CONTINUE.

Scope: Global / Server.

post_archive_script

Specifies a hook script to run after a WAL file is archived, following the post_archive_retry_script.

Scope: Global / Server.

post_backup_retry_script

Specifies a hook script to run after a base backup. Barman will retry this script until it returns SUCCESS (0), ABORT_CONTINUE (62), or ABORT_STOP (63). In a post-backup scenario, ABORT_STOP has the same effect as ABORT_CONTINUE.

Scope: Global / Server.

post_backup_script

Specifies a hook script to run after a base backup, following the post_backup_retry_script.

Scope: Global / Server.

post_delete_retry_script

Specifies a hook script to run after deleting a backup. Barman will retry this script until it returns SUCCESS (0), ABORT_CONTINUE (62), or ABORT_STOP (63). In a post-delete scenario, ABORT_STOP has the same effect as ABORT_CONTINUE.

Scope: Global / Server.

post_delete_script

Specifies a hook script to run after deleting a backup, following the post_delete_retry_script.

Scope: Global / Server.

post_recovery_retry_script

Specifies a hook script to run after a recovery. Barman will retry this script until it returns SUCCESS (0), ABORT_CONTINUE (62), or ABORT_STOP (63). In a post-recovery scenario, ABORT_STOP has the same effect as ABORT_CONTINUE.

Scope: Global / Server.

post_recovery_script

Specifies a hook script to run after a recovery, following the post_recovery_retry_script.

Scope: Global / Server.

post_wal_delete_retry_script

Specifies a hook script to run after deleting a WAL file. Barman will retry this script until it returns SUCCESS (0), ABORT_CONTINUE (62), or ABORT_STOP (63). In a post-WAL-delete scenario, ABORT_STOP has the same effect as ABORT_CONTINUE.

Scope: Global / Server.

post_wal_delete_script

Specifies a hook script to run after deleting a WAL file, following the post_wal_delete_retry_script.

Scope: Global / Server.

pre_archive_retry_script

Specifies a hook script that runs before a WAL file is archived during maintenance, following the pre_archive_script. As a retry hook script, Barman will repeatedly execute the script until it returns either SUCCESS (0), ABORT_CONTINUE (62), or ABORT_STOP (63). Returning ABORT_STOP will escalate the failure and halt the WAL archiving process.

Scope: Global / Server.

pre_archive_script

Specifies a hook script launched before a WAL file is archived by maintenance.

Scope: Global / Server.

pre_backup_retry_script

Specifies a hook script that runs before a base backup, following the pre_backup_script. As a retry hook script, Barman will attempt to execute the script repeatedly until it returns SUCCESS (0), ABORT_CONTINUE (62), or ABORT_STOP (63). Returning ABORT_STOP will escalate the failure and interrupt the backup process.

Scope: Global / Server.

pre_backup_script

Specifies a hook script to run before starting a base backup.

Scope: Global / Server.

pre_delete_retry_script

Specifies a retry hook script to run before backup deletion, following the pre_delete_script. As a retry hook script, Barman will attempt to execute the script repeatedly until it returns SUCCESS (0), ABORT_CONTINUE (62), or ABORT_STOP (63). Returning ABORT_STOP will escalate the failure and interrupt the backup deletion.

Scope: Global / Server.

pre_delete_script

Specifies a hook script run before deleting a backup.

Scope: Global / Server.

pre_recovery_retry_script

Specifies a retry hook script to run before recovery, following the pre_recovery_script. As a retry hook script, Barman will attempt to execute the script repeatedly until it returns SUCCESS (0), ABORT_CONTINUE (62), or ABORT_STOP (63). Returning ABORT_STOP will escalate the failure and interrupt the recover process.

Scope: Global / Server.

pre_recovery_script

Specifies a hook script run before starting a recovery.

Scope: Global / Server.

pre_wal_delete_retry_script

Specifies a retry hook script for WAL file deletion, executed before pre_wal_delete_script. As a retry hook script, Barman will attempt to execute the script repeatedly until it returns SUCCESS (0), ABORT_CONTINUE (62), or ABORT_STOP (63). Returning ABORT_STOP will escalate the failure and interrupt the WAL file deletion.

Scope: Global / Server.

pre_wal_delete_script

Specifies a hook script run before deleting a WAL file.

Scope: Global / Server.

### Write-Ahead Logs (WAL)
These configuration options are related to how Barman will manage the Write-Ahead Logs (WALs) of the PostreSQL servers.

compression

Specifies the standard compression algorithm for WAL files. Options include: lz4, xz, zstd, gzip, pygzip, pigz, bzip2, pybzip2, snappy and custom.

Deprecated since version 3.16: The pygzip and pybzip2 compression options are deprecated and will be removed in a future release. Use their equivalents gzip and bzip2 instead.

Deprecated since version 3.17: The custom compression option and related configuration options (custom_compression_filter, custom_decompression_filter, and custom_compression_magic) are deprecated and will be removed in a future release. Use one of the built-in compression algorithms instead.

Note:

All of these options require the module to be installed in the location where the compression will occur. The custom option is for custom compression, which requires you to set the following options as well:

- custom_compression_filter: a compression filter.

- custom_decompression_filter: a decompression filter

- custom_compression_magic: a hex string to identify a custom compressed wal file.

Scope: Global / Server / Model.

Deprecated since version 3.17: This configuration option is deprecated and will be removed in a future release.

custom_compression_filter

Specifies a custom compression algorithm for WAL files. It must be a string that will be used internally to create a bash command and it will prefix to the following string > "$2" < "$1";. Write to standard output and do not delete input files.

Tip:

custom_compression_filter = "xz -c" This is the same as running xz -c > "$2" < "$1";.

Scope: Global / Server / Model.

Deprecated since version 3.17: This configuration option is deprecated and will be removed in a future release.

custom_compression_magic

Defines a custom magic value to identify the custom compression algorithm used in WAL files. If this is set, Barman will avoid applying custom compression to WALs that have already been compressed with the specified algorithm. If not configured, Barman will apply custom compression to all WAL files, even those pre-compressed.

Tip:

For example, in the xz compression algorithm, the magic number is used to detect the format of .xz files. For xz files, the magic number is the following sequence of bytes:

Magic Number: FD 37 7A 58 5A 00

In hexadecimal representation, this can be expressed as:

Hex String: fd377a585a00

As Barman expects the value of custom_compression_magic to be prefixed with 0x, you would need to set that config option like this:

```
custom_compression_magic = 0xfd377a585a00
```

Reference: xz-file-format <https://tukaani.org/xz/xz-file-format-1.0.4.txt>

Scope: Global / Server / Model.

Deprecated since version 3.17: This configuration option is deprecated and will be removed in a future release.

custom_decompression_filter

Specifies a custom decompression algorithm for compressed WAL files. It must be a string that will be used internally to create a bash command and it will prefix to the following string > "$2" < "$1";. It must correspond with the compression algorithm used.

Tip:

custom_compression_filter = "xz -c -d" This is the same as running xz -c -d > "$2" < "$1";.

Scope: Global / Server / Model.

compression_level

Specifies the compression level to be used by the selected compression algorithm. Valid values are integers within the supported range of the chosen algorithm or one of the predefined labels: low, medium, and high, which serve as shortcuts.

- low: uses low level of compression, favoring compression speed over compression ratio.

- medium: uses a medium level of compression, balancing between compression speed and compression ratio.

- high: uses a high level of compression, favoring compression ratio over compression speed.

Predefined labels map to algorithm-specific levels, as detailed below:

### Compression levels
Algorithm

Level range

low

medium

high

lz4

0 to 16

0

6

10

xz

1 to 9

1

3

5

zstd

-22 to 22

1

4

9

gzip, pygzip and pigz

1 to 9

1

6

9

bzip2 and pybzip2

1 to 9

1

5

9

If the specified compression level is greater than the algorithm's maximum level, that maximum level is used. Similarly, if it is lower than the minimum level, that minimum level is used. The default value is medium.

Scope: Global / Server / Model.

cloud_wal_archive_parallel

Controls the number of WAL files that barman cloud-wal-archive will upload in parallel. When set to N (where N > 1), up to N - 1 additional WAL files that are ready in pg_wal/archive_status are uploaded concurrently in background processes after the primary WAL has been successfully archived. Defaults to 0 (disabled).

Note:

This option only applies when using the local-to-cloud backup method with barman cloud-wal-archive as the archive_command.

Scope: Global / Server.

incoming_wals_directory

Specifies the directory where incoming WAL files are archived. Requires archiver to be enabled. Defaults to <backup_directory>/incoming.

Scope: Server.

last_wal_maximum_age

Defines the time frame within which the latest archived WAL file must fall. If the latest WAL file is older than this period, the barman check command will report an error. If left empty (default), the age of the WAL files is not checked. Format is the same as last_backup_maximum_age.

Scope: Global / Server / Model.

max_incoming_wals_queue

Defines the maximum number of WAL files allowed in the incoming queue (including both streaming and archiving pools) before the barman check command returns an error. Default is None (disabled).

Scope: Global / Server / Model.

streaming_wals_directory

Directory for streaming WAL files. Defaults to <backup_directory>/streaming.

Note:

This option is applicable when streaming_archiver is activated.

Scope: Server.

wal_conninfo

The wal_conninfo connection string is used by Barman for monitoring the status of the replication slot receiving WALs. If specified, it takes precedence over wal_streaming_conninfo for these checks. If wal_conninfo is not set but wal_streaming_conninfo is, wal_conninfo will fall back to wal_streaming_conninfo. If neither wal_conninfo nor wal_streaming_conninfo is set, wal_conninfo will fall back to conninfo. Both connection strings must access a Postgres instance within the same cluster as defined by streaming_conninfo and conninfo. If both wal_conninfo and wal_streaming_conninfo are set, only wal_conninfo needs the appropriate permissions to read settings and check the replication slot status. However, if only wal_streaming_conninfo is set, it must have the necessary permissions to perform these tasks. The required permissions include roles such as pg_monitor, both pg_read_all_settings and pg_read_all_stats, or superuser privileges.

Scope: Server / Model.

wal_streaming_conninfo

This connection string is used by Barman to connect to the Postgres server for receiving WAL segments via streaming replication and checking the replication slot status, if wal_conninfo is not set. If not specified, Barman defaults to using streaming_conninfo for these tasks. wal_streaming_conninfo must connect to a Postgres instance within the same cluster as defined by streaming_conninfo, and it must support streaming replication. If both wal_streaming_conninfo and wal_conninfo are set, only wal_conninfo needs the required permissions to read settings and check the replication slot status. If only wal_streaming_conninfo is specified, it must have these permissions. The necessary permissions include roles such as pg_monitor, both pg_read_all_settings and pg_read_all_stats, or superuser privileges.

Scope: Server / Model.

wals_directory

Destination for archived WAL files. It can be a local path if storing WAL files locally, or a cloud storage URL if storing WAL files in the cloud as described in Streaming backups to the cloud <#backup-streaming-backup-cloud>. Defaults to <backup_directory>/wals.

Warning:

Changing the value of wals_directory on an active server is discouraged. Even if done with care, by deactivating the server, moving existing data to the new location, and reactivating it, there are potential risks of data loss or misconfiguration. Instead, the safe option is to create a new server configuration with the new value for wals_directory, perform a new full backup to the new server, and then decommission the old server once the new one is fully operational.

Scope: Server.

xlogdb_directory

A custom directory for the SERVER-xlog.db file, SERVER being the server name. This file stores metadata of archived WAL files and is used internally by Barman. If unset, it defaults to the value of wals_directory.

Scope: Global / Server.

### Restore
These configuration options are related to how Barman manages restoration backups.

local_staging_path

Specifies the local path for combining block-level incremental backups during recovery. This location must have sufficient space to temporarily store the new synthetic backup. Required for recovery from a block-level incremental backup.

Note:

Applies only when backup_method = postgres.

Deprecated since version 3.15: local_staging_path is deprecated and will be removed in a future release. Use staging_path and staging_location instead.

Scope: Global / Server / Model.

recovery_options

Options for recovery operations. Currently, only get-wal and delta-restore are supported. get-wal enables the creation of a basic restore_command in the recovery configuration, which uses the barman get-wal command to retrieve WAL files directly from Barman's WAL archive. delta-restore allows barman to restore a backup into a pre-existing destination directory along with existing custom tablespaces by overwriting it. This setting accepts a comma-separated list of values and defaults to empty.

Scope: Global / Server / Model.

recovery_staging_path

Specifies the path on the recovery host for staging files from compressed backups. This location must have sufficient space to temporarily store the compressed backup.

Note:

Applies only for compressed backups.

Deprecated since version 3.15: recovery_staging_path is deprecated and will be removed in a future release. Use staging_path and staging_location instead.

Scope: Global / Server / Model.

staging_path

A path where intermediate files are staged during restore. When restoring a compressed backup, it serves as a temporary location for decompression before copying to the final destination. When restoring an incremental backup, it is where backups are combined before copying to the final destination. This location must have enough space to store the decompressed/combined backup. The default is /tmp.

Scope: Global / Server / Model.

staging_location

Specifies whether staging_path is a local or remote path. Valid values are local and remote. The default is local.

Scope: Global / Server / Model.

combine_mode

Specifies a copy mode for pg_combinebackup when combining incremental backups during a restore.

Options include:

- copy (default): Use standard file copying when combining incremental backups.

- link: Use hard links when combining incremental backups. Reconstruction of the synthetic backup might be faster (no file copying) and use less disk space.

- clone: Use efficient file cloning (also known as “reflinks” on some systems) instead of copying files to the new data directory, which can result in near-instantaneous copying of the data files.

- copy-file-range: Use the copy_file_range system call for efficient copying. On some file systems this gives results similar to clone, sharing physical disk blocks, while on others it may still copy blocks, but do so via an optimized path.

Refer to the pg_combinebackup documentation <https://www.postgresql.org/docs/current/app-pgcombinebackup.html> for more details and restrictions of each mode.

Scope: Global / Server / Model.

### Retention Policies
These configuration options are related to how Barman manages retention policies of the backups.

last_backup_maximum_age

Defines the time frame within which the latest backup must fall. If the latest backup is older than this period, the barman check command will report an error. If left empty (default), the latest backup is always considered valid. The accepted format is "n {DAYS|WEEKS|MONTHS|HOURS}", where n is an integer greater than zero.

Scope: Global / Server / Model.

last_backup_minimum_size

Specifies the minimum acceptable size for the latest successful backup. If the latest backup is smaller than this size, the barman check command will report an error. If left empty (default), the latest backup is always considered valid. The accepted format is "n{k|Ki|M|Mi|G|Gi|T|Ti}" and case-sensitive, where n is an integer greater than zero, with an optional SI or IEC suffix. k stands for kilo with k = 1000, while Ki stands for kilobytes Ki = 1024. The rest of the options have the same reasoning for greater units of measure.

Scope: Global / Server / Model.

retention_policy

Defines how long backups and WAL files should be retained. If this option is left blank, no retention policies will be applied. Options include redundancy and recovery window policies.

```
retention_policy = {REDUNDANCY value | RECOVERY WINDOW OF value {DAYS | WEEKS | MONTHS}}
```

- retention_policy = REDUNDANCY 2 will keep only 2 backups in the backup catalog automatically deleting the older one as new backups are created. The number must be a positive integer.

- retention_policy = RECOVERY WINDOW OF 2 DAYS will only keep backups needed to recover to any point in time in the last two days, automatically deleting backups that are older. The period number must be a positive integer, and the following options can be applied to it: DAYS, WEEKS, MONTHS.

Scope: Global / Server / Model.

retention_policy_mode

Mode for enforcing retention policies. Currently only supports auto.

Scope: Global / Server / Model.

wal_retention_policy

Policy for retaining WAL files. Currently only main is available.

Scope: Global / Server / Model.

## CONFIGURATION MODELS
Configuration models provide a systematic approach to manage and apply configuration overrides for Postgres servers by organizing them under a specific cluster name.

### Purpose
The primary goal of a configuration model is to simplify the management of configuration settings for Postgres servers grouped by the same cluster. By using a model, you can apply a set of common configuration overrides, enhancing operational efficiency. They are especially beneficial in clustered environments, allowing you to create various configuration models that can be utilized during failover events.

### Application
The configurations defined in a model file can be applied to Postgres servers that share the same cluster name specified in the model. Consequently, any server utilizing that model can inherit these settings, promoting a consistent and adaptable configuration across all servers.

### Usage
Model options can only be defined within a model section, which is identified in the same way as a server section. It is important to ensure that there are no conflicts between the identifiers of server sections and model sections.

To apply a configuration model, execute the barman config-switch SERVER_NAME MODEL_NAME. This command facilitates the application of the model's overrides to the relevant Postgres server associated with the specified cluster name.

If you wish to remove the overrides, the deletion of the model configuration file alone will not have any effect, so you can do so by using the --reset argument with the command, as follows: barman config-switch SERVER_NAME --reset.

Note:

The config-switch command will only succeed if model name exists and is associated with the same cluster as the server. Additionally, there can be only one active model at a time; if you execute the command multiple times with different models, only the overrides defined in the last model will be applied. Not all options can be configured through models. Please review the scope of the available configurations to determine which settings apply to models.

### Benefits

- Consistency: Ensures uniform configuration across multiple Postgres servers within a cluster.

- Efficiency: Simplifies configuration management by allowing centralized updates and overrides.

- Flexibility: Allows the use of multiple model files, providing the ability to define various sets of overrides as necessary.

## Author
EnterpriseDB

## Copyright
© Copyright EnterpriseDB UK Limited 2011-2025

branch: sisyphus


named.conf

package: bind

title: named.conf(5)

summary: configuration file for **named**

text:
# named.conf(5)

## NAME
named.conf - configuration file for **named**

## SYNOPSIS
named.conf

## DESCRIPTION
named.conf is the configuration file for named <#std-iscman-named>.

For complete documentation about the configuration statements, please refer to the Configuration Reference section in the BIND 9 Administrator Reference Manual.

Statements are enclosed in braces and terminated with a semi-colon. Clauses in the statements are also semi-colon terminated. The usual comment styles are supported:

C style: /* */

C++ style: // to end of line

Unix style: # to end of line

```
acl <string> { <address_match_element>; ... }; // may occur multiple times
controls {
	inet ( <ipv4_address> | <ipv6_address> | * ) [ port ( <integer> | * ) ] allow { <address_match_element>; ... } [ keys { <string>; ... } ] [ read-only <boolean> ]; // may occur multiple times
	unix <quoted_string> perm <integer> owner <integer> group <integer> [ keys { <string>; ... } ] [ read-only <boolean> ]; // may occur multiple times
}; // may occur multiple times
dlz <string> {
	database <string>;
	search <boolean>;
}; // may occur multiple times
dnssec-policy <string> {
	dnskey-ttl <duration>;
	keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime <duration_or_unlimited> algorithm <string> [ <integer> ]; ... };
	max-zone-ttl <duration>;
	nsec3param [ iterations <integer> ] [ optout <boolean> ] [ salt-length <integer> ];
	parent-ds-ttl <duration>;
	parent-propagation-delay <duration>;
	parent-registration-delay <duration>; // obsolete
	publish-safety <duration>;
	purge-keys <duration>;
	retire-safety <duration>;
	signatures-jitter <duration>;
	signatures-refresh <duration>;
	signatures-validity <duration>;
	signatures-validity-dnskey <duration>;
	zone-propagation-delay <duration>;
}; // may occur multiple times
dyndb <string> <quoted_string> { <unspecified-text> }; // may occur multiple times
http <string> {
	endpoints { <quoted_string>; ... };
	listener-clients <integer>;
	streams-per-connection <integer>;
}; // may occur multiple times
key <string> {
	algorithm <string>;
	secret <string>;
}; // may occur multiple times
logging {
	category <string> { <string>; ... }; // may occur multiple times
	channel <string> {
		buffered <boolean>;
		file <quoted_string> [ versions ( unlimited | <integer> ) ] [ size <size> ] [ suffix ( increment | timestamp ) ];
		null;
		print-category <boolean>;
		print-severity <boolean>;
		print-time ( iso8601 | iso8601-utc | local | <boolean> );
		severity <log_severity>;
		stderr;
		syslog [ <syslog_facility> ];
	}; // may occur multiple times
};
managed-keys { <string> ( static-key | initial-key | static-ds | initial-ds ) <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times, deprecated
options {
	allow-new-zones <boolean>;
	allow-notify { <address_match_element>; ... };
	allow-query { <address_match_element>; ... };
	allow-query-cache { <address_match_element>; ... };
	allow-query-cache-on { <address_match_element>; ... };
	allow-query-on { <address_match_element>; ... };
	allow-recursion { <address_match_element>; ... };
	allow-recursion-on { <address_match_element>; ... };
	allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
	allow-update { <address_match_element>; ... };
	allow-update-forwarding { <address_match_element>; ... };
	also-notify [ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
	alt-transfer-source ( <ipv4_address> | * ) ; // deprecated
	alt-transfer-source-v6 ( <ipv6_address> | * ) ; // deprecated
	answer-cookie <boolean>;
	attach-cache <string>;
	auth-nxdomain <boolean>;
	auto-dnssec ( allow | maintain | off ); // deprecated
	automatic-interface-scan <boolean>;
	avoid-v4-udp-ports { <portrange>; ... }; // deprecated
	avoid-v6-udp-ports { <portrange>; ... }; // deprecated
	bindkeys-file <quoted_string>;
	blackhole { <address_match_element>; ... };
	catalog-zones { zone <string> [ default-primaries [ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... } ] [ zone-directory <quoted_string> ] [ in-memory <boolean> ] [ min-update-interval <duration> ]; ... };
	check-dup-records ( fail | warn | ignore );
	check-integrity <boolean>;
	check-mx ( fail | warn | ignore );
	check-mx-cname ( fail | warn | ignore );
	check-names ( primary | master | secondary | slave | response ) ( fail | warn | ignore ); // may occur multiple times
	check-sibling <boolean>;
	check-spf ( warn | ignore );
	check-srv-cname ( fail | warn | ignore );
	check-wildcard <boolean>;
	clients-per-query <integer>;
	cookie-algorithm ( aes | siphash24 );
	cookie-secret <string>; // may occur multiple times
	coresize ( default | unlimited | <sizeval> ); // deprecated
	datasize ( default | unlimited | <sizeval> ); // deprecated
	deny-answer-addresses { <address_match_element>; ... } [ except-from { <string>; ... } ];
	deny-answer-aliases { <string>; ... } [ except-from { <string>; ... } ];
	dialup ( notify | notify-passive | passive | refresh | <boolean> ); // deprecated
	directory <quoted_string>;
	disable-algorithms <string> { <string>; ... }; // may occur multiple times
	disable-ds-digests <string> { <string>; ... }; // may occur multiple times
	disable-empty-zone <string>; // may occur multiple times
	dns64 <netprefix> {
		break-dnssec <boolean>;
		clients { <address_match_element>; ... };
		exclude { <address_match_element>; ... };
		mapped { <address_match_element>; ... };
		recursive-only <boolean>;
		suffix <ipv6_address>;
	}; // may occur multiple times
	dns64-contact <string>;
	dns64-server <string>;
	dnskey-sig-validity <integer>;
	dnsrps-enable <boolean>; // not configured
	dnsrps-options { <unspecified-text> }; // not configured
	dnssec-accept-expired <boolean>;
	dnssec-dnskey-kskonly <boolean>;
	dnssec-loadkeys-interval <integer>;
	dnssec-must-be-secure <string> <boolean>; // may occur multiple times, deprecated
	dnssec-policy <string>;
	dnssec-secure-to-insecure <boolean>;
	dnssec-update-mode ( maintain | no-resign );
	dnssec-validation ( yes | no | auto );
	dnstap { ( all | auth | client | forwarder | resolver | update ) [ ( query | response ) ]; ... }; // not configured
	dnstap-identity ( <quoted_string> | none | hostname ); // not configured
	dnstap-output ( file | unix ) <quoted_string> [ size ( unlimited | <size> ) ] [ versions ( unlimited | <integer> ) ] [ suffix ( increment | timestamp ) ]; // not configured
	dnstap-version ( <quoted_string> | none ); // not configured
	dscp <integer>; // obsolete
	dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port <integer> ] | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ); ... };
	dump-file <quoted_string>;
	edns-udp-size <integer>;
	empty-contact <string>;
	empty-server <string>;
	empty-zones-enable <boolean>;
	fetch-quota-params <integer> <fixedpoint> <fixedpoint> <fixedpoint>;
	fetches-per-server <integer> [ ( drop | fail ) ];
	fetches-per-zone <integer> [ ( drop | fail ) ];
	files ( default | unlimited | <sizeval> ); // deprecated
	flush-zones-on-shutdown <boolean>;
	forward ( first | only );
	forwarders [ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
	fstrm-set-buffer-hint <integer>; // not configured
	fstrm-set-flush-timeout <integer>; // not configured
	fstrm-set-input-queue-size <integer>; // not configured
	fstrm-set-output-notify-threshold <integer>; // not configured
	fstrm-set-output-queue-model ( mpsc | spsc ); // not configured
	fstrm-set-output-queue-size <integer>; // not configured
	fstrm-set-reopen-interval <duration>; // not configured
	geoip-directory ( <quoted_string> | none );
	glue-cache <boolean>; // deprecated
	heartbeat-interval <integer>; // deprecated
	hostname ( <quoted_string> | none );
	http-listener-clients <integer>;
	http-port <integer>;
	http-streams-per-connection <integer>;
	https-port <integer>;
	interface-interval <duration>;
	ipv4only-contact <string>;
	ipv4only-enable <boolean>;
	ipv4only-server <string>;
	ixfr-from-differences ( primary | master | secondary | slave | <boolean> );
	keep-response-order { <address_match_element>; ... };
	key-directory <quoted_string>;
	lame-ttl <duration>;
	listen-on [ port <integer> ] [ tls <string> ] [ http <string> ] { <address_match_element>; ... }; // may occur multiple times
	listen-on-v6 [ port <integer> ] [ tls <string> ] [ http <string> ] { <address_match_element>; ... }; // may occur multiple times
	lmdb-mapsize <sizeval>;
	lock-file ( <quoted_string> | none );
	managed-keys-directory <quoted_string>;
	masterfile-format ( raw | text );
	masterfile-style ( full | relative );
	match-mapped-addresses <boolean>;
	max-cache-size ( default | unlimited | <sizeval> | <percentage> );
	max-cache-ttl <duration>;
	max-clients-per-query <integer>;
	max-ixfr-ratio ( unlimited | <percentage> );
	max-journal-size ( default | unlimited | <sizeval> );
	max-ncache-ttl <duration>;
	max-query-count <integer>;
	max-query-restarts <integer>;
	max-records <integer>;
	max-records-per-type <integer>;
	max-recursion-depth <integer>;
	max-recursion-queries <integer>;
	max-refresh-time <integer>;
	max-retry-time <integer>;
	max-rsa-exponent-size <integer>;
	max-stale-ttl <duration>;
	max-transfer-idle-in <integer>;
	max-transfer-idle-out <integer>;
	max-transfer-time-in <integer>;
	max-transfer-time-out <integer>;
	max-types-per-name <integer>;
	max-udp-size <integer>;
	max-zone-ttl ( unlimited | <duration> );
	memstatistics <boolean>;
	memstatistics-file <quoted_string>;
	message-compression <boolean>;
	min-cache-ttl <duration>;
	min-ncache-ttl <duration>;
	min-refresh-time <integer>;
	min-retry-time <integer>;
	minimal-any <boolean>;
	minimal-responses ( no-auth | no-auth-recursive | <boolean> );
	multi-master <boolean>;
	new-zones-directory <quoted_string>;
	no-case-compress { <address_match_element>; ... };
	nocookie-udp-size <integer>;
	notify ( explicit | master-only | primary-only | <boolean> );
	notify-delay <integer>;
	notify-rate <integer>;
	notify-source ( <ipv4_address> | * ) ;
	notify-source-v6 ( <ipv6_address> | * ) ;
	notify-to-soa <boolean>;
	nsec3-test-zone <boolean>; // test only
	nta-lifetime <duration>;
	nta-recheck <duration>;
	nxdomain-redirect <string>;
	parental-source ( <ipv4_address> | * ) ;
	parental-source-v6 ( <ipv6_address> | * ) ;
	pid-file ( <quoted_string> | none );
	port <integer>;
	preferred-glue <string>;
	prefetch <integer> [ <integer> ];
	provide-ixfr <boolean>;
	qname-minimization ( strict | relaxed | disabled | off );
	query-source [ address ] ( <ipv4_address> | * );
	query-source-v6 [ address ] ( <ipv6_address> | * );
	querylog <boolean>;
	random-device ( <quoted_string> | none ); // obsolete
	rate-limit {
		all-per-second <integer>;
		errors-per-second <integer>;
		exempt-clients { <address_match_element>; ... };
		ipv4-prefix-length <integer>;
		ipv6-prefix-length <integer>;
		log-only <boolean>;
		max-table-size <integer>;
		min-table-size <integer>;
		nodata-per-second <integer>;
		nxdomains-per-second <integer>;
		qps-scale <integer>;
		referrals-per-second <integer>;
		responses-per-second <integer>;
		slip <integer>;
		window <integer>;
	};
	recursing-file <quoted_string>;
	recursion <boolean>;
	recursive-clients <integer>;
	request-expire <boolean>;
	request-ixfr <boolean>;
	request-nsid <boolean>;
	require-server-cookie <boolean>;
	reserved-sockets <integer>; // deprecated
	resolver-nonbackoff-tries <integer>; // deprecated
	resolver-query-timeout <integer>;
	resolver-retry-interval <integer>; // deprecated
	response-padding { <address_match_element>; ... } block-size <integer>;
	response-policy { zone <string> [ add-soa <boolean> ] [ log <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ policy ( cname | disabled | drop | given | no-op | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ]; ... } [ add-soa <boolean> ] [ break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ min-ns-dots <integer> ] [ nsip-wait-recurse <boolean> ] [ nsdname-wait-recurse <boolean> ] [ qname-wait-recurse <boolean> ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [ dnsrps-enable <boolean> ] [ dnsrps-options { <unspecified-text> } ];
	reuseport <boolean>;
	root-delegation-only [ exclude { <string>; ... } ]; // deprecated
	root-key-sentinel <boolean>;
	rrset-order { [ class <string> ] [ type <string> ] [ name <quoted_string> ] <string> <string>; ... };
	secroots-file <quoted_string>;
	send-cookie <boolean>;
	serial-query-rate <integer>;
	serial-update-method ( date | increment | unixtime );
	server-id ( <quoted_string> | none | hostname );
	servfail-ttl <duration>;
	session-keyalg <string>;
	session-keyfile ( <quoted_string> | none );
	session-keyname <string>;
	sig-signing-nodes <integer>;
	sig-signing-signatures <integer>;
	sig-signing-type <integer>;
	sig-validity-interval <integer> [ <integer> ];
	sortlist { <address_match_element>; ... };
	stacksize ( default | unlimited | <sizeval> ); // deprecated
	stale-answer-client-timeout ( disabled | off | <integer> );
	stale-answer-enable <boolean>;
	stale-answer-ttl <duration>;
	stale-cache-enable <boolean>;
	stale-refresh-time <duration>;
	startup-notify-rate <integer>;
	statistics-file <quoted_string>;
	suppress-initial-notify <boolean>; // obsolete
	synth-from-dnssec <boolean>;
	tcp-advertised-timeout <integer>;
	tcp-clients <integer>;
	tcp-idle-timeout <integer>;
	tcp-initial-timeout <integer>;
	tcp-keepalive-timeout <integer>;
	tcp-listen-queue <integer>;
	tcp-receive-buffer <integer>;
	tcp-send-buffer <integer>;
	tkey-dhkey <quoted_string> <integer>; // deprecated
	tkey-domain <quoted_string>; // deprecated
	tkey-gssapi-credential <quoted_string>; // deprecated
	tkey-gssapi-keytab <quoted_string>;
	tls-port <integer>;
	transfer-format ( many-answers | one-answer );
	transfer-message-size <integer>;
	transfer-source ( <ipv4_address> | * ) ;
	transfer-source-v6 ( <ipv6_address> | * ) ;
	transfers-in <integer>;
	transfers-out <integer>;
	transfers-per-ns <integer>;
	trust-anchor-telemetry <boolean>;
	try-tcp-refresh <boolean>;
	udp-receive-buffer <integer>;
	udp-send-buffer <integer>;
	update-check-ksk <boolean>;
	update-quota <integer>;
	use-alt-transfer-source <boolean>; // deprecated
	use-v4-udp-ports { <portrange>; ... }; // deprecated
	use-v6-udp-ports { <portrange>; ... }; // deprecated
	v6-bias <integer>;
	validate-except { <string>; ... };
	version ( <quoted_string> | none );
	zero-no-soa-ttl <boolean>;
	zero-no-soa-ttl-cache <boolean>;
	zone-statistics ( full | terse | none | <boolean> );
};
parental-agents <string> [ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }; // may occur multiple times
plugin ( query ) <string> [ { <unspecified-text> } ]; // may occur multiple times
primaries <string> [ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }; // may occur multiple times
server <netprefix> {
	bogus <boolean>;
	edns <boolean>;
	edns-udp-size <integer>;
	edns-version <integer>;
	keys <server_key>;
	max-udp-size <integer>;
	notify-source ( <ipv4_address> | * ) ;
	notify-source-v6 ( <ipv6_address> | * ) ;
	padding <integer>;
	provide-ixfr <boolean>;
	query-source [ address ] ( <ipv4_address> | * );
	query-source-v6 [ address ] ( <ipv6_address> | * );
	request-expire <boolean>;
	request-ixfr <boolean>;
	request-nsid <boolean>;
	send-cookie <boolean>;
	tcp-keepalive <boolean>;
	tcp-only <boolean>;
	transfer-format ( many-answers | one-answer );
	transfer-source ( <ipv4_address> | * ) ;
	transfer-source-v6 ( <ipv6_address> | * ) ;
	transfers <integer>;
}; // may occur multiple times
statistics-channels {
	inet ( <ipv4_address> | <ipv6_address> | * ) [ port ( <integer> | * ) ] [ allow { <address_match_element>; ... } ]; // may occur multiple times
}; // may occur multiple times
tls <string> {
	ca-file <quoted_string>;
	cert-file <quoted_string>;
	ciphers <string>;
	dhparam-file <quoted_string>;
	key-file <quoted_string>;
	prefer-server-ciphers <boolean>;
	protocols { <string>; ... };
	remote-hostname <quoted_string>;
	session-tickets <boolean>;
}; // may occur multiple times
trust-anchors { <string> ( static-key | initial-key | static-ds | initial-ds ) <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times
trusted-keys { <string> <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times, deprecated
view <string> [ <class> ] {
	allow-new-zones <boolean>;
	allow-notify { <address_match_element>; ... };
	allow-query { <address_match_element>; ... };
	allow-query-cache { <address_match_element>; ... };
	allow-query-cache-on { <address_match_element>; ... };
	allow-query-on { <address_match_element>; ... };
	allow-recursion { <address_match_element>; ... };
	allow-recursion-on { <address_match_element>; ... };
	allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
	allow-update { <address_match_element>; ... };
	allow-update-forwarding { <address_match_element>; ... };
	also-notify [ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
	alt-transfer-source ( <ipv4_address> | * ) ; // deprecated
	alt-transfer-source-v6 ( <ipv6_address> | * ) ; // deprecated
	attach-cache <string>;
	auth-nxdomain <boolean>;
	auto-dnssec ( allow | maintain | off ); // deprecated
	catalog-zones { zone <string> [ default-primaries [ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... } ] [ zone-directory <quoted_string> ] [ in-memory <boolean> ] [ min-update-interval <duration> ]; ... };
	check-dup-records ( fail | warn | ignore );
	check-integrity <boolean>;
	check-mx ( fail | warn | ignore );
	check-mx-cname ( fail | warn | ignore );
	check-names ( primary | master | secondary | slave | response ) ( fail | warn | ignore ); // may occur multiple times
	check-sibling <boolean>;
	check-spf ( warn | ignore );
	check-srv-cname ( fail | warn | ignore );
	check-wildcard <boolean>;
	clients-per-query <integer>;
	deny-answer-addresses { <address_match_element>; ... } [ except-from { <string>; ... } ];
	deny-answer-aliases { <string>; ... } [ except-from { <string>; ... } ];
	dialup ( notify | notify-passive | passive | refresh | <boolean> ); // deprecated
	disable-algorithms <string> { <string>; ... }; // may occur multiple times
	disable-ds-digests <string> { <string>; ... }; // may occur multiple times
	disable-empty-zone <string>; // may occur multiple times
	dlz <string> {
		database <string>;
		search <boolean>;
	}; // may occur multiple times
	dns64 <netprefix> {
		break-dnssec <boolean>;
		clients { <address_match_element>; ... };
		exclude { <address_match_element>; ... };
		mapped { <address_match_element>; ... };
		recursive-only <boolean>;
		suffix <ipv6_address>;
	}; // may occur multiple times
	dns64-contact <string>;
	dns64-server <string>;
	dnskey-sig-validity <integer>;
	dnsrps-enable <boolean>; // not configured
	dnsrps-options { <unspecified-text> }; // not configured
	dnssec-accept-expired <boolean>;
	dnssec-dnskey-kskonly <boolean>;
	dnssec-loadkeys-interval <integer>;
	dnssec-must-be-secure <string> <boolean>; // may occur multiple times, deprecated
	dnssec-policy <string>;
	dnssec-secure-to-insecure <boolean>;
	dnssec-update-mode ( maintain | no-resign );
	dnssec-validation ( yes | no | auto );
	dnstap { ( all | auth | client | forwarder | resolver | update ) [ ( query | response ) ]; ... }; // not configured
	dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port <integer> ] | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ); ... };
	dyndb <string> <quoted_string> { <unspecified-text> }; // may occur multiple times
	edns-udp-size <integer>;
	empty-contact <string>;
	empty-server <string>;
	empty-zones-enable <boolean>;
	fetch-quota-params <integer> <fixedpoint> <fixedpoint> <fixedpoint>;
	fetches-per-server <integer> [ ( drop | fail ) ];
	fetches-per-zone <integer> [ ( drop | fail ) ];
	forward ( first | only );
	forwarders [ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
	glue-cache <boolean>; // deprecated
	ipv4only-contact <string>;
	ipv4only-enable <boolean>;
	ipv4only-server <string>;
	ixfr-from-differences ( primary | master | secondary | slave | <boolean> );
	key <string> {
		algorithm <string>;
		secret <string>;
	}; // may occur multiple times
	key-directory <quoted_string>;
	lame-ttl <duration>;
	lmdb-mapsize <sizeval>;
	managed-keys { <string> ( static-key | initial-key | static-ds | initial-ds ) <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times, deprecated
	masterfile-format ( raw | text );
	masterfile-style ( full | relative );
	match-clients { <address_match_element>; ... };
	match-destinations { <address_match_element>; ... };
	match-recursive-only <boolean>;
	max-cache-size ( default | unlimited | <sizeval> | <percentage> );
	max-cache-ttl <duration>;
	max-clients-per-query <integer>;
	max-ixfr-ratio ( unlimited | <percentage> );
	max-journal-size ( default | unlimited | <sizeval> );
	max-ncache-ttl <duration>;
	max-query-count <integer>;
	max-query-restarts <integer>;
	max-records <integer>;
	max-records-per-type <integer>;
	max-recursion-depth <integer>;
	max-recursion-queries <integer>;
	max-refresh-time <integer>;
	max-retry-time <integer>;
	max-stale-ttl <duration>;
	max-transfer-idle-in <integer>;
	max-transfer-idle-out <integer>;
	max-transfer-time-in <integer>;
	max-transfer-time-out <integer>;
	max-types-per-name <integer>;
	max-udp-size <integer>;
	max-zone-ttl ( unlimited | <duration> );
	message-compression <boolean>;
	min-cache-ttl <duration>;
	min-ncache-ttl <duration>;
	min-refresh-time <integer>;
	min-retry-time <integer>;
	minimal-any <boolean>;
	minimal-responses ( no-auth | no-auth-recursive | <boolean> );
	multi-master <boolean>;
	new-zones-directory <quoted_string>;
	no-case-compress { <address_match_element>; ... };
	nocookie-udp-size <integer>;
	notify ( explicit | master-only | primary-only | <boolean> );
	notify-delay <integer>;
	notify-source ( <ipv4_address> | * ) ;
	notify-source-v6 ( <ipv6_address> | * ) ;
	notify-to-soa <boolean>;
	nsec3-test-zone <boolean>; // test only
	nta-lifetime <duration>;
	nta-recheck <duration>;
	nxdomain-redirect <string>;
	parental-source ( <ipv4_address> | * ) ;
	parental-source-v6 ( <ipv6_address> | * ) ;
	plugin ( query ) <string> [ { <unspecified-text> } ]; // may occur multiple times
	preferred-glue <string>;
	prefetch <integer> [ <integer> ];
	provide-ixfr <boolean>;
	qname-minimization ( strict | relaxed | disabled | off );
	query-source [ address ] ( <ipv4_address> | * );
	query-source-v6 [ address ] ( <ipv6_address> | * );
	rate-limit {
		all-per-second <integer>;
		errors-per-second <integer>;
		exempt-clients { <address_match_element>; ... };
		ipv4-prefix-length <integer>;
		ipv6-prefix-length <integer>;
		log-only <boolean>;
		max-table-size <integer>;
		min-table-size <integer>;
		nodata-per-second <integer>;
		nxdomains-per-second <integer>;
		qps-scale <integer>;
		referrals-per-second <integer>;
		responses-per-second <integer>;
		slip <integer>;
		window <integer>;
	};
	recursion <boolean>;
	request-expire <boolean>;
	request-ixfr <boolean>;
	request-nsid <boolean>;
	require-server-cookie <boolean>;
	resolver-nonbackoff-tries <integer>; // deprecated
	resolver-query-timeout <integer>;
	resolver-retry-interval <integer>; // deprecated
	response-padding { <address_match_element>; ... } block-size <integer>;
	response-policy { zone <string> [ add-soa <boolean> ] [ log <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ policy ( cname | disabled | drop | given | no-op | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ]; ... } [ add-soa <boolean> ] [ break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ min-ns-dots <integer> ] [ nsip-wait-recurse <boolean> ] [ nsdname-wait-recurse <boolean> ] [ qname-wait-recurse <boolean> ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [ dnsrps-enable <boolean> ] [ dnsrps-options { <unspecified-text> } ];
	root-delegation-only [ exclude { <string>; ... } ]; // deprecated
	root-key-sentinel <boolean>;
	rrset-order { [ class <string> ] [ type <string> ] [ name <quoted_string> ] <string> <string>; ... };
	send-cookie <boolean>;
	serial-update-method ( date | increment | unixtime );
	server <netprefix> {
		bogus <boolean>;
		edns <boolean>;
		edns-udp-size <integer>;
		edns-version <integer>;
		keys <server_key>;
		max-udp-size <integer>;
		notify-source ( <ipv4_address> | * ) ;
		notify-source-v6 ( <ipv6_address> | * ) ;
		padding <integer>;
		provide-ixfr <boolean>;
		query-source [ address ] ( <ipv4_address> | * );
		query-source-v6 [ address ] ( <ipv6_address> | * );
		request-expire <boolean>;
		request-ixfr <boolean>;
		request-nsid <boolean>;
		send-cookie <boolean>;
		tcp-keepalive <boolean>;
		tcp-only <boolean>;
		transfer-format ( many-answers | one-answer );
		transfer-source ( <ipv4_address> | * ) ;
		transfer-source-v6 ( <ipv6_address> | * ) ;
		transfers <integer>;
	}; // may occur multiple times
	servfail-ttl <duration>;
	sig-signing-nodes <integer>;
	sig-signing-signatures <integer>;
	sig-signing-type <integer>;
	sig-validity-interval <integer> [ <integer> ];
	sortlist { <address_match_element>; ... };
	stale-answer-client-timeout ( disabled | off | <integer> );
	stale-answer-enable <boolean>;
	stale-answer-ttl <duration>;
	stale-cache-enable <boolean>;
	stale-refresh-time <duration>;
	suppress-initial-notify <boolean>; // obsolete
	synth-from-dnssec <boolean>;
	transfer-format ( many-answers | one-answer );
	transfer-source ( <ipv4_address> | * ) ;
	transfer-source-v6 ( <ipv6_address> | * ) ;
	trust-anchor-telemetry <boolean>;
	trust-anchors { <string> ( static-key | initial-key | static-ds | initial-ds ) <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times
	trusted-keys { <string> <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times, deprecated
	try-tcp-refresh <boolean>;
	update-check-ksk <boolean>;
	use-alt-transfer-source <boolean>; // deprecated
	v6-bias <integer>;
	validate-except { <string>; ... };
	zero-no-soa-ttl <boolean>;
	zero-no-soa-ttl-cache <boolean>;
	zone-statistics ( full | terse | none | <boolean> );
}; // may occur multiple times
```

Any of these zone statements can also be set inside the view statement.

```
zone <string> [ <class> ] {
	type primary;
	allow-query { <address_match_element>; ... };
	allow-query-on { <address_match_element>; ... };
	allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
	allow-update { <address_match_element>; ... };
	also-notify [ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
	alt-transfer-source ( <ipv4_address> | * ) ; // deprecated
	alt-transfer-source-v6 ( <ipv6_address> | * ) ; // deprecated
	auto-dnssec ( allow | maintain | off ); // deprecated
	check-dup-records ( fail | warn | ignore );
	check-integrity <boolean>;
	check-mx ( fail | warn | ignore );
	check-mx-cname ( fail | warn | ignore );
	check-names ( fail | warn | ignore );
	check-sibling <boolean>;
	check-spf ( warn | ignore );
	check-srv-cname ( fail | warn | ignore );
	check-wildcard <boolean>;
	database <string>;
	dialup ( notify | notify-passive | passive | refresh | <boolean> ); // deprecated
	dlz <string>;
	dnskey-sig-validity <integer>;
	dnssec-dnskey-kskonly <boolean>;
	dnssec-loadkeys-interval <integer>;
	dnssec-policy <string>;
	dnssec-secure-to-insecure <boolean>;
	dnssec-update-mode ( maintain | no-resign );
	file <quoted_string>;
	forward ( first | only );
	forwarders [ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
	inline-signing <boolean>;
	ixfr-from-differences <boolean>;
	journal <quoted_string>;
	key-directory <quoted_string>;
	masterfile-format ( raw | text );
	masterfile-style ( full | relative );
	max-ixfr-ratio ( unlimited | <percentage> );
	max-journal-size ( default | unlimited | <sizeval> );
	max-records <integer>;
	max-records-per-type <integer>;
	max-transfer-idle-out <integer>;
	max-transfer-time-out <integer>;
	max-types-per-name <integer>;
	max-zone-ttl ( unlimited | <duration> );
	notify ( explicit | master-only | primary-only | <boolean> );
	notify-delay <integer>;
	notify-source ( <ipv4_address> | * ) ;
	notify-source-v6 ( <ipv6_address> | * ) ;
	notify-to-soa <boolean>;
	nsec3-test-zone <boolean>; // test only
	parental-agents [ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
	parental-source ( <ipv4_address> | * ) ;
	parental-source-v6 ( <ipv6_address> | * ) ;
	serial-update-method ( date | increment | unixtime );
	sig-signing-nodes <integer>;
	sig-signing-signatures <integer>;
	sig-signing-type <integer>;
	sig-validity-interval <integer> [ <integer> ];
	update-check-ksk <boolean>;
	update-policy ( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | krb5-subdomain-self-rhs | ms-self | ms-selfsub | ms-subdomain | ms-subdomain-self-rhs | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... } );
	zero-no-soa-ttl <boolean>;
	zone-statistics ( full | terse | none | <boolean> );
};
```

```
zone <string> [ <class> ] {
	type secondary;
	allow-notify { <address_match_element>; ... };
	allow-query { <address_match_element>; ... };
	allow-query-on { <address_match_element>; ... };
	allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
	allow-update-forwarding { <address_match_element>; ... };
	also-notify [ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
	alt-transfer-source ( <ipv4_address> | * ) ; // deprecated
	alt-transfer-source-v6 ( <ipv6_address> | * ) ; // deprecated
	auto-dnssec ( allow | maintain | off ); // deprecated
	check-names ( fail | warn | ignore );
	database <string>;
	dialup ( notify | notify-passive | passive | refresh | <boolean> ); // deprecated
	dlz <string>;
	dnskey-sig-validity <integer>;
	dnssec-dnskey-kskonly <boolean>;
	dnssec-loadkeys-interval <integer>;
	dnssec-policy <string>;
	dnssec-update-mode ( maintain | no-resign );
	file <quoted_string>;
	forward ( first | only );
	forwarders [ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
	inline-signing <boolean>;
	ixfr-from-differences <boolean>;
	journal <quoted_string>;
	key-directory <quoted_string>;
	masterfile-format ( raw | text );
	masterfile-style ( full | relative );
	max-ixfr-ratio ( unlimited | <percentage> );
	max-journal-size ( default | unlimited | <sizeval> );
	max-records <integer>;
	max-records-per-type <integer>;
	max-refresh-time <integer>;
	max-retry-time <integer>;
	max-transfer-idle-in <integer>;
	max-transfer-idle-out <integer>;
	max-transfer-time-in <integer>;
	max-transfer-time-out <integer>;
	max-types-per-name <integer>;
	min-refresh-time <integer>;
	min-retry-time <integer>;
	multi-master <boolean>;
	notify ( explicit | master-only | primary-only | <boolean> );
	notify-delay <integer>;
	notify-source ( <ipv4_address> | * ) ;
	notify-source-v6 ( <ipv6_address> | * ) ;
	notify-to-soa <boolean>;
	nsec3-test-zone <boolean>; // test only
	parental-agents [ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
	parental-source ( <ipv4_address> | * ) ;
	parental-source-v6 ( <ipv6_address> | * ) ;
	primaries [ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
	request-expire <boolean>;
	request-ixfr <boolean>;
	sig-signing-nodes <integer>;
	sig-signing-signatures <integer>;
	sig-signing-type <integer>;
	sig-validity-interval <integer> [ <integer> ];
	transfer-source ( <ipv4_address> | * ) ;
	transfer-source-v6 ( <ipv6_address> | * ) ;
	try-tcp-refresh <boolean>;
	update-check-ksk <boolean>;
	use-alt-transfer-source <boolean>; // deprecated
	zero-no-soa-ttl <boolean>;
	zone-statistics ( full | terse | none | <boolean> );
};
```

```
zone <string> [ <class> ] {
	type mirror;
	allow-notify { <address_match_element>; ... };
	allow-query { <address_match_element>; ... };
	allow-query-on { <address_match_element>; ... };
	allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
	allow-update-forwarding { <address_match_element>; ... };
	also-notify [ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
	alt-transfer-source ( <ipv4_address> | * ) ; // deprecated
	alt-transfer-source-v6 ( <ipv6_address> | * ) ; // deprecated
	check-names ( fail | warn | ignore );
	database <string>;
	file <quoted_string>;
	ixfr-from-differences <boolean>;
	journal <quoted_string>;
	masterfile-format ( raw | text );
	masterfile-style ( full | relative );
	max-ixfr-ratio ( unlimited | <percentage> );
	max-journal-size ( default | unlimited | <sizeval> );
	max-records <integer>;
	max-records-per-type <integer>;
	max-refresh-time <integer>;
	max-retry-time <integer>;
	max-transfer-idle-in <integer>;
	max-transfer-idle-out <integer>;
	max-transfer-time-in <integer>;
	max-transfer-time-out <integer>;
	max-types-per-name <integer>;
	min-refresh-time <integer>;
	min-retry-time <integer>;
	multi-master <boolean>;
	notify ( explicit | master-only | primary-only | <boolean> );
	notify-delay <integer>;
	notify-source ( <ipv4_address> | * ) ;
	notify-source-v6 ( <ipv6_address> | * ) ;
	primaries [ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
	request-expire <boolean>;
	request-ixfr <boolean>;
	transfer-source ( <ipv4_address> | * ) ;
	transfer-source-v6 ( <ipv6_address> | * ) ;
	try-tcp-refresh <boolean>;
	use-alt-transfer-source <boolean>; // deprecated
	zero-no-soa-ttl <boolean>;
	zone-statistics ( full | terse | none | <boolean> );
};
```

```
zone <string> [ <class> ] {
	type forward;
	delegation-only <boolean>; // deprecated
	forward ( first | only );
	forwarders [ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
};
```

```
zone <string> [ <class> ] {
	type hint;
	check-names ( fail | warn | ignore );
	delegation-only <boolean>; // deprecated
	file <quoted_string>;
};
```

```
zone <string> [ <class> ] {
	type redirect;
	allow-query { <address_match_element>; ... };
	allow-query-on { <address_match_element>; ... };
	dlz <string>;
	file <quoted_string>;
	masterfile-format ( raw | text );
	masterfile-style ( full | relative );
	max-records <integer>;
	max-records-per-type <integer>;
	max-types-per-name <integer>;
	max-zone-ttl ( unlimited | <duration> );
	primaries [ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
	zone-statistics ( full | terse | none | <boolean> );
};
```

```
zone <string> [ <class> ] {
	type static-stub;
	allow-query { <address_match_element>; ... };
	allow-query-on { <address_match_element>; ... };
	forward ( first | only );
	forwarders [ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
	max-records <integer>;
	max-records-per-type <integer>;
	max-types-per-name <integer>;
	server-addresses { ( <ipv4_address> | <ipv6_address> ); ... };
	server-names { <string>; ... };
	zone-statistics ( full | terse | none | <boolean> );
};
```

```
zone <string> [ <class> ] {
	type stub;
	allow-query { <address_match_element>; ... };
	allow-query-on { <address_match_element>; ... };
	check-names ( fail | warn | ignore );
	database <string>;
	delegation-only <boolean>; // deprecated
	dialup ( notify | notify-passive | passive | refresh | <boolean> ); // deprecated
	file <quoted_string>;
	forward ( first | only );
	forwarders [ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
	masterfile-format ( raw | text );
	masterfile-style ( full | relative );
	max-records <integer>;
	max-records-per-type <integer>;
	max-refresh-time <integer>;
	max-retry-time <integer>;
	max-transfer-idle-in <integer>;
	max-transfer-time-in <integer>;
	max-types-per-name <integer>;
	min-refresh-time <integer>;
	min-retry-time <integer>;
	multi-master <boolean>;
	primaries [ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
	transfer-source ( <ipv4_address> | * ) ;
	transfer-source-v6 ( <ipv6_address> | * ) ;
	use-alt-transfer-source <boolean>; // deprecated
	zone-statistics ( full | terse | none | <boolean> );
};
```

```
zone <string> [ <class> ] {
	type delegation-only;
};
```

```
zone <string> [ <class> ] {
	in-view <string>;
};
```

## FILES
/etc/named.conf

## SEE ALSO
named(8) <#std-iscman-named>, named-checkconf(8) <#std-iscman-named-checkconf>, rndc(8) <#std-iscman-rndc>, rndc-confgen(8) <#std-iscman-rndc-confgen>, tsig-keygen(8) <#std-iscman-tsig-keygen>, BIND 9 Administrator Reference Manual.

## Author
Internet Systems Consortium

## Copyright
2026, Internet Systems Consortium


rndc.conf

title: rndc.conf(5)

summary: rndc configuration file

text:
# rndc.conf(5)

## NAME
rndc.conf - rndc configuration file

## SYNOPSIS
rndc.conf

## DESCRIPTION
rndc.conf is the configuration file for rndc <#std-iscman-rndc>, the BIND 9 name server control utility. This file has a similar structure and syntax to named.conf <#std-iscman-named.conf>. Statements are enclosed in braces and terminated with a semi-colon. Clauses in the statements are also semi-colon terminated. The usual comment styles are supported:

C style: /* */

C++ style: // to end of line

Unix style: # to end of line

rndc.conf is much simpler than named.conf <#std-iscman-named.conf>. The file uses three statements: an options statement, a server statement, and a key statement.

The options statement contains five clauses. The default-server clause is followed by the name or address of a name server. This host is used when no name server is given as an argument to rndc <#std-iscman-rndc>. The default-key clause is followed by the name of a key, which is identified by a key statement. If no keyid is provided on the rndc command line, and no key clause is found in a matching server statement, this default key is used to authenticate the server's commands and responses. The default-port clause is followed by the port to connect to on the remote name server. If no port option is provided on the rndc command line, and no port clause is found in a matching server statement, this default port is used to connect. The default-source-address and default-source-address-v6 clauses can be used to set the IPv4 and IPv6 source addresses respectively.

After the server keyword, the server statement includes a string which is the hostname or address for a name server. The statement has three possible clauses: key, port, and addresses. The key name must match the name of a key statement in the file. The port number specifies the port to connect to. If an addresses clause is supplied, these addresses are used instead of the server name. Each address can take an optional port. If an source-address or source-address-v6 is supplied, it is used to specify the IPv4 and IPv6 source address, respectively.

The key statement begins with an identifying string, the name of the key. The statement has two clauses. algorithm identifies the authentication algorithm for rndc <#std-iscman-rndc> to use; currently only HMAC-MD5 (for compatibility), HMAC-SHA1, HMAC-SHA224, HMAC-SHA256 (default), HMAC-SHA384, and HMAC-SHA512 are supported. This is followed by a secret clause which contains the base-64 encoding of the algorithm's authentication key. The base-64 string is enclosed in double quotes.

There are two common ways to generate the base-64 string for the secret. The BIND 9 program rndc-confgen <#std-iscman-rndc-confgen> can be used to generate a random key, or the mmencode program, also known as mimencode, can be used to generate a base-64 string from known input. mmencode does not ship with BIND 9 but is available on many systems. See the Example section for sample command lines for each.

## EXAMPLE

```
options {

  default-server  localhost;

  default-key     samplekey;
};
```

```
server localhost {

  key             samplekey;
};
```

```
server testserver {

  key     testkey;

  addresses   { localhost port 5353; };
};
```

```
key samplekey {

  algorithm       hmac-sha256;

  secret          "6FMfj43Osz4lyb24OIe2iGEz9lf1llJO+lz";
};
```

```
key testkey {

  algorithm   hmac-sha256;

  secret      "R3HI8P6BKw9ZwXwN3VZKuQ==";
};
```

In the above example, rndc <#std-iscman-rndc> by default uses the server at localhost (127.0.0.1) and the key called "samplekey". Commands to the localhost server use the "samplekey" key, which must also be defined in the server's configuration file with the same name and secret. The key statement indicates that "samplekey" uses the HMAC-SHA256 algorithm and its secret clause contains the base-64 encoding of the HMAC-SHA256 secret enclosed in double quotes.

If rndc -s testserver <#cmdoption-rndc-s> is used, then rndc <#std-iscman-rndc> connects to the server on localhost port 5353 using the key "testkey".

To generate a random secret with rndc-confgen <#std-iscman-rndc-confgen>:

rndc-confgen <#std-iscman-rndc-confgen>

A complete rndc.conf file, including the randomly generated key, is written to the standard output. Commented-out key and controls statements for named.conf <#std-iscman-named.conf> are also printed.

To generate a base-64 secret with mmencode:

echo "known plaintext for a secret" | mmencode

## NAME SERVER CONFIGURATION
The name server must be configured to accept rndc connections and to recognize the key specified in the rndc.conf file, using the controls statement in named.conf <#std-iscman-named.conf>. See the sections on the controls statement in the BIND 9 Administrator Reference Manual for details.

## SEE ALSO
rndc(8) <#std-iscman-rndc>, rndc-confgen(8) <#std-iscman-rndc-confgen>, mmencode(1), BIND 9 Administrator Reference Manual.

## Author
Internet Systems Consortium

## Copyright
2026, Internet Systems Consortium