##
## This is an example configuration file for the Hickory DNS named server.
##
## The format is in TOML: https://github.com/toml-lang/toml which was chosen
##  as the configuration format for Hickory DNS. While Hickory DNS is intended to
##  be a drop-in replacement for BIND9, it will not support the named.conf files
##  directly. At some point, there will be a binary tool for converting the
##  BIND9 configuration files over to Hickory DNS TOML.
##
## Many of these options are available as both command line options and
##  configuration options in these files. In that case, the command line option
##  will take precedence.
##
## Comments with two hash marks, ##, document the config parameter
## Comments with one hash mark, #, is an example line and should be the default
##
## The root options are similar to the options in 'options { .. }' in named.conf

## listen_addrs: address on which to listen for incoming connections
##  this can be a list of ipv4 or ipv6 addresses
# listen_addrs_ipv4 = ["0.0.0.0"]
# listen_addrs_ipv6 = ["::0"]

## listen_port: port on which to list, default 53
# listen_port = 53

## tcp_request_timeout: TCP request timeout in seconds. Allows TCP connections
##  to timeout if there are no requests from a client in the specified amount of
##  time. This is not a socket level timeout, so trickles of data will not count,
##  a full request must be received for it to not count against the timeout.
##  Specifying a timeout of 0 will disable it.
# tcp_request_timeout = 5

## DNS over TLS certificate information.
# tls_cert = { path = "path/to/some.pkcs12", password = "if_encrypted" }

## port on which to listen, default 853 (should not be 53)
# tls_listen_port = 853

## directory: path on the host filesystem to where zone files are stored.
# directory = "/var/named"

## Denied networks, a list of CIDRs in IPv4 or IPv6 formats,
##  any request that does not originate from the specified networks will be allowed
# deny_networks = ["127.0.0.0/8", "::1/128"]

## Allowed networks, a list of CIDRs in IPv4 or IPv6 formats,
##  any request that does not originate from the specified networks will be denied, unless
##  there are deny_networks specified, in that case, the allow list will be processed as
##  an override to the deny_networks. That is, if there is a deny_list and the network does
##  not appear there, even if does not appear in the allow list the request will be allowd.
# allow_networks = ["127.0.0.0/8", "::1/128"]

## Default zones, these should be present on all nameservers, except in rare
##  configuration cases
[[zones]]
zone = "localhost"
zone_type = "Primary"
file = "default/localhost.zone"

[[zones]]
zone = "0.0.127.in-addr.arpa"
zone_type = "Primary"
file = "default/127.0.0.1.zone"

[[zones]]
zone = "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa"
zone_type = "Primary"
file = "default/ipv6_1.zone"

[[zones]]
zone = "255.in-addr.arpa"
zone_type = "Primary"
file = "default/255.zone"

[[zones]]
zone = "0.in-addr.arpa"
zone_type = "Primary"
file = "default/0.zone"

[[zones]]
## zone: this is the ORIGIN of the zone, aka the base name, '.' is implied on the end
zone = "example.com"

## zone_type: Primary, Secondary, Hint, Forward
zone_type = "Primary"

## file: this is relative to the directory above
file = "example.com.zone"

## if false, updates will not be allowed, default false
# allow_update = false

## if false, AXFRs requests will result in Refused responses
# allow_axfr = false

## if true, looks to see if a chained pem file exists at $file.pem (see
## supported_algorithms below).
## these keys will also be registered as authorities for update,
## meaning that SIG(0) updates can be established by initially using these
## keys. the zone will be signed with all specified keys, it may be desirable
## to limit this set for performance reasons.
# enable_dnssec = false

## set of DNSSEC algorithms to use to sign the zone. enable_dnssec must be true.
## these will be lookedup by $file.{key_name}.pem, for backward compatibility
## with previous versions of Hickory DNS, if enable_dnssec is enabled but
## supported_algorithms is not specified, it will default to "RSASHA256" and
## look for the $file.pem for the key. To control key length, or other options
## keys of the specified formats can be generated in PEM format. Instructions
## for custom keys can be found elsewhere.
##
## supported extensions are 'der', 'pem'. ED25519 keys are only supported
## with 'pk8'.
##
## the currently supported set of supported_algorithms are
## ["RSASHA256", "RSASHA512", "ECDSAP256SHA256", "ECDSAP384SHA384", "ED25519"]
##
## keys are listed in pairs of key_name and algorithm, the search path is the
## same directory has the zone $file (this section would be relative to the
## example.com zone):
# [[zones.keys]]
## relative to the zone $file
# key_path = "my_rsa_2048.pem"
## the password used to encrypt/decrypt the file (must be PEM), blank for none
# password = ""
## specify the algorithm
# algorithm = "RSASHA256"
## this key should be used to sign the zone
# is_zone_signing_key = true
## this key is authorized for dynamic update access to the zone via SIG0
# is_zone_update_auth = true
#
# [[zones.keys]]
# key_path = "/path/to/my_ed25519.pk8"
# algorithm = "ED25519"
## for keys that are not zone signing, the pem need only include the pubic_key
# is_zone_signing_key = false
# is_zone_update_auth = true
