|
|
cc5fe49 |
#
|
|
|
cc5fe49 |
# nsd.conf -- the NSD(8) configuration file, nsd.conf(5).
|
|
|
cc5fe49 |
#
|
|
|
cc5fe49 |
# Copyright (c) 2001-2011, NLnet Labs. All rights reserved.
|
|
|
cc5fe49 |
#
|
|
|
cc5fe49 |
# See LICENSE for the license.
|
|
|
cc5fe49 |
#
|
|
|
cc5fe49 |
|
|
|
cc5fe49 |
# This is a comment.
|
|
|
d60e0c3 |
# Sample configuration file
|
|
|
d60e0c3 |
# include: "file" # include that file's text over here. Globbed, "*.conf"
|
|
|
cc5fe49 |
|
|
|
cc5fe49 |
# options for the nsd server
|
|
|
cc5fe49 |
server:
|
|
|
d60e0c3 |
# Number of NSD servers to fork. Put the number of CPUs to use here.
|
|
|
d60e0c3 |
# server-count: 1
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# uncomment to specify specific interfaces to bind (default are the
|
|
|
d60e0c3 |
# wildcard interfaces 0.0.0.0 and ::0).
|
|
|
3319bb0 |
# For servers with multiple IP addresses, list them one by one,
|
|
|
3319bb0 |
# or the source address of replies could be wrong.
|
|
|
3319bb0 |
# Use ip-transparent to be able to list addresses that turn on later.
|
|
|
cc5fe49 |
# ip-address: 1.2.3.4
|
|
|
cc5fe49 |
# ip-address: 1.2.3.4@5678
|
|
|
cc5fe49 |
# ip-address: 12fe::8ef0
|
|
|
cc5fe49 |
|
|
|
a486d27 |
# Allow binding to non local addresses. Default no.
|
|
|
a486d27 |
# ip-transparent: no
|
|
|
a486d27 |
|
|
|
cbe2e9e |
# Allow binding to addresses that are down. Default no.
|
|
|
cbe2e9e |
# ip-freebind: no
|
|
|
cbe2e9e |
|
|
|
3319bb0 |
# use the reuseport socket option for performance. Default no.
|
|
|
3319bb0 |
# reuseport: no
|
|
|
3319bb0 |
|
|
|
8711dd1 |
# override maximum socket send buffer size. Default of 0 results in
|
|
|
8711dd1 |
# send buffer size being set to 1048576 (bytes).
|
|
|
8711dd1 |
# send-buffer-size: 1048576
|
|
|
8711dd1 |
|
|
|
8711dd1 |
# override maximum socket receive buffer size. Default of 0 results in
|
|
|
8711dd1 |
# receive buffer size being set to 1048576 (bytes).
|
|
|
8711dd1 |
# receive-buffer-size: 1048576
|
|
|
8711dd1 |
|
|
|
cc5fe49 |
# enable debug mode, does not fork daemon process into the background.
|
|
|
cc5fe49 |
# debug-mode: no
|
|
|
cc5fe49 |
|
|
|
d60e0c3 |
# listen on IPv4 connections
|
|
|
d60e0c3 |
# do-ip4: yes
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# listen on IPv6 connections
|
|
|
d60e0c3 |
# do-ip6: yes
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# port to answer queries on. default is 53.
|
|
|
d60e0c3 |
# port: 53
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# Verbosity level.
|
|
|
d60e0c3 |
# verbosity: 0
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# After binding socket, drop user privileges.
|
|
|
d60e0c3 |
# can be a username, id or id.gid.
|
|
|
3319bb0 |
# username: nsd
|
|
|
cc5fe49 |
|
|
|
d60e0c3 |
# Run NSD in a chroot-jail.
|
|
|
d60e0c3 |
# make sure to have pidfile and database reachable from there.
|
|
|
d60e0c3 |
# by default, no chroot-jail is used.
|
|
|
d60e0c3 |
# chroot: "/etc/nsd"
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# The directory for zonefile: files. The daemon chdirs here.
|
|
|
3319bb0 |
# zonesdir: "/etc/nsd"
|
|
|
3319bb0 |
|
|
|
d60e0c3 |
# the list of dynamically added zones.
|
|
|
3319bb0 |
# zonelistfile: "/var/lib/nsd/zone.list"
|
|
|
d60e0c3 |
|
|
|
cc5fe49 |
# the database to use
|
|
|
d60e0c3 |
# if set to "" then no disk-database is used, less memory usage.
|
|
|
30c0456 |
database: ""
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# log messages to file. Default to stderr and syslog (with
|
|
|
d60e0c3 |
# facility LOG_DAEMON). stderr disappears when daemon goes to bg.
|
|
|
3319bb0 |
# logfile: "/var/log/nsd.log"
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# File to store pid for nsd in.
|
|
|
8711dd1 |
# pidfile: "/run/nsd/nsd.pid"
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# The file where secondary zone refresh and expire timeouts are kept.
|
|
|
3319bb0 |
# If you delete this file, all secondary zones are forced to be
|
|
|
d60e0c3 |
# 'refreshing' (as if nsd got a notify). Set to "" to disable.
|
|
|
d60e0c3 |
# xfrdfile: "/var/lib/nsd/ixfr.state"
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# The directory where zone transfers are stored, in a subdir of it.
|
|
|
3319bb0 |
# xfrdir: "/tmp"
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# don't answer VERSION.BIND and VERSION.SERVER CHAOS class queries
|
|
|
d60e0c3 |
# hide-version: no
|
|
|
cc5fe49 |
|
|
|
8711dd1 |
# don't answer HOSTNAME.BIND and ID.SERVER CHAOS class queries
|
|
|
8711dd1 |
# hide-identity: no
|
|
|
8711dd1 |
|
|
|
3319bb0 |
# version string the server responds with for chaos queries.
|
|
|
3319bb0 |
# default is 'NSD x.y.z' with the server's version number.
|
|
|
3319bb0 |
# version: "NSD"
|
|
|
3319bb0 |
|
|
|
cc5fe49 |
# identify the server (CH TXT ID.SERVER entry).
|
|
|
cc5fe49 |
# identity: "unidentified server"
|
|
|
cc5fe49 |
|
|
|
d60e0c3 |
# NSID identity (hex string, or "ascii_somestring"). default disabled.
|
|
|
cc5fe49 |
# nsid: "aabbccdd"
|
|
|
cc5fe49 |
|
|
|
cc5fe49 |
# Maximum number of concurrent TCP connections per server.
|
|
|
d60e0c3 |
# tcp-count: 100
|
|
|
cc5fe49 |
|
|
|
8711dd1 |
# Accept (and immediately close) TCP connections after maximum number
|
|
|
8711dd1 |
# of connections is reached to prevent kernel connection queue from
|
|
|
8711dd1 |
# growing.
|
|
|
8711dd1 |
# tcp-reject-overflow: no
|
|
|
8711dd1 |
|
|
|
cc5fe49 |
# Maximum number of queries served on a single TCP connection.
|
|
|
cc5fe49 |
# By default 0, which means no maximum.
|
|
|
cc5fe49 |
# tcp-query-count: 0
|
|
|
cc5fe49 |
|
|
|
cc5fe49 |
# Override the default (120 seconds) TCP timeout.
|
|
|
cc5fe49 |
# tcp-timeout: 120
|
|
|
cc5fe49 |
|
|
|
cbe2e9e |
# Maximum segment size (MSS) of TCP socket on which the server
|
|
|
cbe2e9e |
# responds to queries. Default is 0, system default MSS.
|
|
|
cbe2e9e |
# tcp-mss: 0
|
|
|
cbe2e9e |
|
|
|
cbe2e9e |
# Maximum segment size (MSS) of TCP socket for outgoing AXFR request.
|
|
|
cbe2e9e |
# Default is 0, system default MSS.
|
|
|
cbe2e9e |
# outgoing-tcp-mss: 0
|
|
|
cbe2e9e |
|
|
|
cc5fe49 |
# Preferred EDNS buffer size for IPv4.
|
|
|
cc5fe49 |
# ipv4-edns-size: 4096
|
|
|
cc5fe49 |
|
|
|
cc5fe49 |
# Preferred EDNS buffer size for IPv6.
|
|
|
cc5fe49 |
# ipv6-edns-size: 4096
|
|
|
cc5fe49 |
|
|
|
d60e0c3 |
# statistics are produced every number of seconds. Prints to log.
|
|
|
d60e0c3 |
# Default is 0, meaning no statistics are produced.
|
|
|
3319bb0 |
# statistics: 3600
|
|
|
cc5fe49 |
|
|
|
cc5fe49 |
# Number of seconds between reloads triggered by xfrd.
|
|
|
d60e0c3 |
# xfrd-reload-timeout: 1
|
|
|
3319bb0 |
|
|
|
d60e0c3 |
# log timestamp in ascii (y-m-d h:m:s.msec), yes is default.
|
|
|
d60e0c3 |
# log-time-ascii: yes
|
|
|
cc5fe49 |
|
|
|
d60e0c3 |
# round robin rotation of records in the answer.
|
|
|
69123d0 |
round-robin: yes
|
|
|
d60e0c3 |
|
|
|
30c0456 |
# minimal-responses only emits extra data for referrals.
|
|
|
69123d0 |
minimal-responses: yes
|
|
|
69123d0 |
|
|
|
ed632f3 |
# Do not return additional information if the apex zone of the
|
|
|
ed632f3 |
# additional information is configured but does not match the apex zone
|
|
|
ed632f3 |
# of the initial query.
|
|
|
ed632f3 |
# confine-to-zone: no
|
|
|
ed632f3 |
|
|
|
69123d0 |
# refuse queries of type ANY. For stopping floods.
|
|
|
69123d0 |
refuse-any: yes
|
|
|
30c0456 |
|
|
|
d60e0c3 |
# check mtime of all zone files on start and sighup
|
|
|
d60e0c3 |
# zonefiles-check: yes
|
|
|
3319bb0 |
|
|
|
d60e0c3 |
# write changed zonefiles to disk, every N seconds.
|
|
|
d60e0c3 |
# default is 0(disabled) or 3600(if database is "").
|
|
|
cbe2e9e |
# zonefiles-write: 3600
|
|
|
cc5fe49 |
|
|
|
a486d27 |
# RRLconfig
|
|
|
a486d27 |
# Response Rate Limiting, size of the hashtable. Default 1000000.
|
|
|
a486d27 |
# rrl-size: 1000000
|
|
|
a486d27 |
|
|
|
a486d27 |
# Response Rate Limiting, maximum QPS allowed (from one query source).
|
|
|
3319bb0 |
# If set to 0, ratelimiting is disabled. Also set
|
|
|
a486d27 |
# rrl-whitelist-ratelimit to 0 to disable ratelimit processing.
|
|
|
3319bb0 |
# Default is on.
|
|
|
a486d27 |
# rrl-ratelimit: 200
|
|
|
a486d27 |
|
|
|
a486d27 |
# Response Rate Limiting, number of packets to discard before
|
|
|
a486d27 |
# sending a SLIP response (a truncated one, allowing an honest
|
|
|
a486d27 |
# resolver to retry with TCP). Default is 2 (one half of the
|
|
|
a486d27 |
# queries will receive a SLIP response, 0 disables SLIP (all
|
|
|
a486d27 |
# packets are discarded), 1 means every request will get a
|
|
|
3319bb0 |
# SLIP response. When the ratelimit is hit the traffic is
|
|
|
3319bb0 |
# divided by the rrl-slip value.
|
|
|
a486d27 |
# rrl-slip: 2
|
|
|
a486d27 |
|
|
|
a486d27 |
# Response Rate Limiting, IPv4 prefix length. Addresses are
|
|
|
3319bb0 |
# grouped by netblock.
|
|
|
a486d27 |
# rrl-ipv4-prefix-length: 24
|
|
|
a486d27 |
|
|
|
a486d27 |
# Response Rate Limiting, IPv6 prefix length. Addresses are
|
|
|
3319bb0 |
# grouped by netblock.
|
|
|
a486d27 |
# rrl-ipv6-prefix-length: 64
|
|
|
a486d27 |
|
|
|
a486d27 |
# Response Rate Limiting, maximum QPS allowed (from one query source)
|
|
|
3319bb0 |
# for whitelisted types. Default is on.
|
|
|
a486d27 |
# rrl-whitelist-ratelimit: 2000
|
|
|
a486d27 |
# RRLend
|
|
|
a486d27 |
|
|
|
3319bb0 |
# Optional local server config
|
|
|
3319bb0 |
include: "/etc/nsd/server.d/*.conf"
|
|
|
3319bb0 |
|
|
|
3319bb0 |
# Include optional local configs.
|
|
|
3319bb0 |
include: "/etc/nsd/conf.d/*.conf"
|
|
|
3319bb0 |
|
|
|
8711dd1 |
# Fedora: DNSTAP not yet enabled
|
|
|
8711dd1 |
# dnstap:
|
|
|
8711dd1 |
# set this to yes and set one or more of dnstap-log-..-messages to yes.
|
|
|
8711dd1 |
# dnstap-enable: no
|
|
|
8711dd1 |
# dnstap-socket-path: "/var/run/dnstap.sock"
|
|
|
8711dd1 |
# dnstap-send-identity: no
|
|
|
8711dd1 |
# dnstap-send-version: no
|
|
|
8711dd1 |
# dnstap-identity: ""
|
|
|
8711dd1 |
# dnstap-version: ""
|
|
|
8711dd1 |
# dnstap-log-auth-query-messages: no
|
|
|
8711dd1 |
# dnstap-log-auth-response-messages: no
|
|
|
8711dd1 |
|
|
|
8711dd1 |
# Service clients over TLS (on the TCP sockets), with plain DNS inside
|
|
|
8711dd1 |
# the TLS stream. Give the certificate to use and private key.
|
|
|
8711dd1 |
# Default is "" (disabled). Requires restart to take effect.
|
|
|
8711dd1 |
# tls-service-key: "path/to/privatekeyfile.key"
|
|
|
8711dd1 |
# tls-service-pem: "path/to/publiccertfile.pem"
|
|
|
8711dd1 |
# tls-service-ocsp: "path/to/ocsp.pem"
|
|
|
8711dd1 |
# tls-port: 853
|
|
|
8711dd1 |
|
|
|
3319bb0 |
# Remote control config section.
|
|
|
d60e0c3 |
remote-control:
|
|
|
d60e0c3 |
# Enable remote control with nsd-control(8) here.
|
|
|
d60e0c3 |
# set up the keys and certificates with nsd-control-setup.
|
|
|
d60e0c3 |
control-enable: yes
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# what interfaces are listened to for control, default is on localhost.
|
|
|
8711dd1 |
# with an absolute path, a unix local named pipe is used for control
|
|
|
8711dd1 |
# (and key and cert files are not needed, use directory permissions).
|
|
|
d60e0c3 |
# control-interface: 127.0.0.1
|
|
|
d60e0c3 |
# control-interface: ::1
|
|
|
6e6b286 |
control-interface: /run/nsd/nsd.ctl
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# port number for remote control operations (uses TLS over TCP).
|
|
|
d60e0c3 |
# control-port: 8952
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# nsd server key file for remote control.
|
|
|
3319bb0 |
# server-key-file: "/etc/nsd/nsd_server.key"
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# nsd server certificate file for remote control.
|
|
|
3319bb0 |
# server-cert-file: "/etc/nsd/nsd_server.pem"
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# nsd-control key file.
|
|
|
3319bb0 |
# control-key-file: "/etc/nsd/nsd_control.key"
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# nsd-control certificate file.
|
|
|
3319bb0 |
# control-cert-file: "/etc/nsd/nsd_control.pem"
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# Secret keys for TSIGs that secure zone transfers.
|
|
|
d60e0c3 |
# You could include: "secret.keys" and put the 'key:' statements in there,
|
|
|
d60e0c3 |
# and give that file special access control permissions.
|
|
|
d60e0c3 |
#
|
|
|
d60e0c3 |
# key:
|
|
|
d60e0c3 |
# The key name is sent to the other party, it must be the same
|
|
|
d60e0c3 |
#name: "keyname"
|
|
|
69123d0 |
# algorithm hmac-md5, or sha1, sha256, sha224, sha384, sha512
|
|
|
69123d0 |
#algorithm: sha256
|
|
|
d60e0c3 |
# secret material, must be the same as the other party uses.
|
|
|
d60e0c3 |
# base64 encoded random number.
|
|
|
d60e0c3 |
# e.g. from dd if=/dev/random of=/dev/stdout count=1 bs=32 | base64
|
|
|
d60e0c3 |
#secret: "K2tf3TRjvQkVCmJF3/Z9vA=="
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# Patterns have zone configuration and they are shared by one or more zones.
|
|
|
3319bb0 |
#
|
|
|
d60e0c3 |
# pattern:
|
|
|
d60e0c3 |
# name by which the pattern is referred to
|
|
|
d60e0c3 |
#name: "myzones"
|
|
|
d60e0c3 |
# the zonefile for the zones that use this pattern.
|
|
|
d60e0c3 |
# if relative then from the zonesdir (inside the chroot).
|
|
|
d60e0c3 |
# the name is processed: %s - zone name (as appears in zone:name).
|
|
|
d60e0c3 |
# %1 - first character of zone name, %2 second, %3 third.
|
|
|
d60e0c3 |
# %z - topleveldomain label of zone, %y, %x next labels in name.
|
|
|
d60e0c3 |
# if label or character does not exist you get a dot '.'.
|
|
|
d60e0c3 |
# for example "%s.zone" or "zones/%1/%2/%3/%s" or "secondary/%z/%s"
|
|
|
d60e0c3 |
#zonefile: "%s.zone"
|
|
|
3319bb0 |
|
|
|
d60e0c3 |
# If no master and slave access control elements are provided,
|
|
|
d60e0c3 |
# this zone will not be served to/from other servers.
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# A master zone needs notify: and provide-xfr: lists. A slave
|
|
|
d60e0c3 |
# may also allow zone transfer (for debug or other secondaries).
|
|
|
d60e0c3 |
# notify these slaves when the master zone changes, address TSIG|NOKEY
|
|
|
d60e0c3 |
# IP can be ipv4 and ipv6, with @port for a nondefault port number.
|
|
|
d60e0c3 |
#notify: 192.0.2.1 NOKEY
|
|
|
d60e0c3 |
# allow these IPs and TSIG to transfer zones, addr TSIG|NOKEY|BLOCKED
|
|
|
d60e0c3 |
# address range 192.0.2.0/24, 1.2.3.4&255.255.0.0, 3.0.2.20-3.0.2.40
|
|
|
d60e0c3 |
#provide-xfr: 192.0.2.0/24 my_tsig_key_name
|
|
|
d60e0c3 |
# set the number of retries for notify.
|
|
|
d60e0c3 |
#notify-retry: 5
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# uncomment to provide AXFR to all the world
|
|
|
d60e0c3 |
# provide-xfr: 0.0.0.0/0 NOKEY
|
|
|
d60e0c3 |
# provide-xfr: ::0/0 NOKEY
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# A slave zone needs allow-notify: and request-xfr: lists.
|
|
|
d60e0c3 |
#allow-notify: 2001:db8::0/64 my_tsig_key_name
|
|
|
d60e0c3 |
# By default, a slave will request a zone transfer with IXFR/TCP.
|
|
|
d60e0c3 |
# If you want to make use of IXFR/UDP use: UDP addr tsigkey
|
|
|
d60e0c3 |
# for a master that only speaks AXFR (like NSD) use AXFR addr tsigkey
|
|
|
d60e0c3 |
#request-xfr: 192.0.2.2 the_tsig_key_name
|
|
|
3319bb0 |
# Attention: You cannot use UDP and AXFR together. AXFR is always over
|
|
|
d60e0c3 |
# TCP. If you use UDP, we higly recommend you to deploy TSIG.
|
|
|
d60e0c3 |
# Allow AXFR fallback if the master does not support IXFR. Default
|
|
|
d60e0c3 |
# is yes.
|
|
|
d60e0c3 |
#allow-axfr-fallback: yes
|
|
|
d60e0c3 |
# set local interface for sending zone transfer requests.
|
|
|
d60e0c3 |
# default is let the OS choose.
|
|
|
d60e0c3 |
#outgoing-interface: 10.0.0.10
|
|
|
8c83e6e |
# limit the refresh and retry interval in seconds.
|
|
|
8c83e6e |
#max-refresh-time: 2419200
|
|
|
8c83e6e |
#min-refresh-time: 0
|
|
|
8c83e6e |
#max-retry-time: 1209600
|
|
|
8c83e6e |
#min-retry-time: 0
|
|
|
8c83e6e |
|
|
|
30c0456 |
# Slave server tries zone transfer to all masters and picks highest
|
|
|
30c0456 |
# zone version available, for when masters have different versions.
|
|
|
30c0456 |
#multi-master-check: no
|
|
|
30c0456 |
|
|
|
8c83e6e |
# limit the zone transfer size (in bytes), stops very large transfers
|
|
|
8c83e6e |
# 0 is no limits enforced.
|
|
|
8c83e6e |
# size-limit-xfr: 0
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# if compiled with --enable-zone-stats, give name of stat block for
|
|
|
d60e0c3 |
# this zone (or group of zones). Output from nsd-control stats.
|
|
|
d60e0c3 |
# zonestats: "%s"
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# if you give another pattern name here, at this point the settings
|
|
|
3319bb0 |
# from that pattern are inserted into this one (as if it were a
|
|
|
d60e0c3 |
# macro). The statement can be given in between other statements,
|
|
|
d60e0c3 |
# because the order of access control elements can make a difference
|
|
|
d60e0c3 |
# (which master to request from first, which slave to notify first).
|
|
|
d60e0c3 |
#include-pattern: "common-masters"
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# Fixed zone entries. Here you can config zones that cannot be deleted.
|
|
|
d60e0c3 |
# Zones that are dynamically added and deleted are put in the zonelist file.
|
|
|
d60e0c3 |
#
|
|
|
d60e0c3 |
# zone:
|
|
|
3319bb0 |
# name: "example.com"
|
|
|
3319bb0 |
# you can give a pattern here, all the settings from that pattern
|
|
|
3319bb0 |
# are then inserted at this point
|
|
|
3319bb0 |
# include-pattern: "master"
|
|
|
3319bb0 |
# You can also specify (additional) options directly for this zone.
|
|
|
3319bb0 |
# zonefile: "example.com.zone"
|
|
|
3319bb0 |
# request-xfr: 192.0.2.1 example.com.key
|
|
|
d60e0c3 |
|
|
|
d60e0c3 |
# RRLconfig
|
|
|
d60e0c3 |
# Response Rate Limiting, whitelist types
|
|
|
d60e0c3 |
# rrl-whitelist: nxdomain
|
|
|
d60e0c3 |
# rrl-whitelist: error
|
|
|
d60e0c3 |
# rrl-whitelist: referral
|
|
|
d60e0c3 |
# rrl-whitelist: any
|
|
|
d60e0c3 |
# rrl-whitelist: rrsig
|
|
|
d60e0c3 |
# rrl-whitelist: wildcard
|
|
|
d60e0c3 |
# rrl-whitelist: nodata
|
|
|
d60e0c3 |
# rrl-whitelist: dnskey
|
|
|
d60e0c3 |
# rrl-whitelist: positive
|
|
|
d60e0c3 |
# rrl-whitelist: all
|
|
|
d60e0c3 |
# RRLend
|
|
|
8711dd1 |
|
|
|
8711dd1 |
|