// $Id: named.conf 2241 2015-08-03 02:17:26Z jhealy $
//
// This is a BIND 9 configuration for Suffield Academy.
//
// Before using this file, perform a search for FIXME::, and change
// any occurances to proper values.
//

//
// Include keys file
//
include "/etc/rndc.key";

// Include Suffield keys
include "/etc/named.suffieldconf.d/keys.inc";

// Include Suffield ACLs
include "/etc/named.suffieldconf.d/acls.inc";

// Declares control channels to be used by the rndc utility.
//
// It is recommended that 127.0.0.1 be the only address used.
// This also allows non-privileged users on the local host to manage
// your name server.

//
// Default controls
//
controls {
	inet 127.0.0.1 port 54 allow {any;}
	keys { "rndc-key"; };
};

options {
	directory "/opt/local/var/named";
	/*
	 * If there is a firewall between you and nameservers you want
	 * to talk to, you might need to uncomment the query-source
	 * directive below.  Previous versions of BIND always asked
	 * questions using port 53, but BIND 8.1 uses an unprivileged
	 * port by default.
	 */
	// query-source address * port 53;

	// Only listen on the published interfaces we want to use
	// FIXME: add IP address(es) you want to listen on
	listen-on { 127.0.0.1; };

	// allow transfers only to hosts with correct crypto keys
	allow-transfer { key internal-slave-transfer; };

	// allow recursion only for trusted clients
	allow-recursion { recursion-clients; };

	// Use our primary DNS server for non-cached queries
	// FIXME: uncomment if you wish to "chain" all non-cached
	// queries to another host.  This can be helpful for
	// caching, but does add latency (and a single point of failure)
        // Use CEN's caching servers
	forwarders { 67.218.95.5; 207.210.151.5; };

	// Send notify announcements by default.  For slave zones, you
	// may wish to set "notify no;" in each zone stanza to prevent
	// the slave from sending unecessary notifies.
	notify yes;

	// keep the cached domain size reasonable
	max-cache-size 10M;

	// Increase the number of resursive clients we support
	// (default is 1000)
	recursive-clients 2000;

};


logging {

	// default Apple Mac OS X Server channel
        channel _default_log  {
                file "/Library/Logs/named.log";
                severity notice;
		// if you're having problems, crank up the logging level:
                //severity info;
                print-time yes;
        };

	// channel directing output to syslog
	channel suffield_syslog_info {
		syslog local5;
		severity info;
	};

	// channel directing output to syslog, ignoring
	// non-critical messages
	channel suffield_syslog_notice {
		syslog local5;
		// default level is "info", but we only want major
		// warnings to go to syslog
		severity notice;
	};

	// Logging Categories (specify unique destinations where desired)

	// catch-all for categories not specifically mentioned
        category default { _default_log; suffield_syslog_notice; };

	// all messages that do not get their own category
	category general { _default_log; suffield_syslog_notice; };

	// processing client requests
	category client { _default_log; suffield_syslog_notice; };

	// config file parsing and processing
	category config { _default_log; suffield_syslog_info; };

	// internal db status; zone data and cache records
	category database { _default_log; suffield_syslog_info; };

	// processing DNSSEC-signed responses
	category dnssec { _default_log; suffield_syslog_info; };

	// Detection of bad delegation
	category lame-servers { _default_log; suffield_syslog_info; };

	// network operations
	category network { _default_log; suffield_syslog_notice; };

	// zone change notifications
	category notify { _default_log; suffield_syslog_notice; };

	// query logging (do not enable unless you want a lot of messages)
	// category queries { _default_log; suffield_syslog_info; };

	// name resolution and recursive queries
	category resolver { _default_log; suffield_syslog_notice; };

	// approved/unapproved requests
	category security { _default_log; suffield_syslog_notice; };

	// dynamic update events
	category update { _default_log; suffield_syslog_notice; };

	// zone transfers from remote name servers to this one
	category xfer-in { _default_log; suffield_syslog_notice; };

	// zone transfers from this name server to others
	category xfer-out { _default_log; suffield_syslog_notice; };

};


view "internal" {
     // FIXME: if you wish to send updates from an IP address other
     //        than the default, specify it with these two options
     // transfer-source IP.GOES.HERE;
     // notify-source IP.GOES.HERE;

     match-clients { internals; };

     // FIXME: decide if you want to include MASTER or SLAVE configs
     //        (you may only choose one per view)
     // include "/etc/named.suffieldconf.d/master_internal_zones.inc";
     // include "/etc/named.suffieldconf.d/slave_internal_zones.inc";

     // We should always be the master for caching domains
     include "/etc/named.suffieldconf.d/caching_zones.inc";

};

view "external" {
     // FIXME: if you wish to send updates from an IP address other
     //        than the default, specify it with these two options
     // transfer-source IP.GOES.HERE;
     // notify-source IP.GOES.HERE;

     match-clients { externals; };

     // FIXME: decide if you want to include MASTER or SLAVE configs
     //        (you may only choose one per view)
     // include "/etc/named.suffieldconf.d/master_external_zones.inc";
     // include "/etc/named.suffieldconf.d/slave_external_zones.inc";

     // We should always be the master for caching domains
     include "/etc/named.suffieldconf.d/caching_zones.inc";

};

