#=============================================
# Stub Zones
#=============================================

# There may be multiple "stub-zone:" clauses. Each with a "name:" and zero or
# more hostnames or IP addresses. For the stub zone this list of name-servers is
# used. Class "IN" is assumed. The servers should be authority servers, not
# recursors; unbound  performs the recursive processing itself for stub
# zones.
#
# The stub zone can be used to configure authoritative data to be used by the
# resolver that cannot be accessed using the public internet servers. This is
# useful for company-local data or private zones. Setup an authoritative server
# on a different host (or different port). Enter a config entry for unbound
# with "stub-addr: <ip address of host[@port]>". The unbound resolver can then
# access the data, without referring to the public internet for it.
#
# This setup allows DNSSEC signed zones to be served by that authoritative
# server, in which case a trusted key entry with the public key can be put in
# config, so that unbound can validate the data and set the "AD" bit on replies
# for the private zone (authoritative servers do not set the "AD" bit). This
# setup makes unbound capable of answering queries for the private zone, and can
# even set the "AD" bit ('authentic'), but the "AA" ('authoritative') bit is not
# set on these replies.
#
# Consider adding "server:" statements for "domain-insecure:" and for "local-
# zone: name nodefault" for the zone if it is a locally served zone. The
# insecure clause stops DNSSEC from invalidating the zone. The "local-zone:
# nodefault"  (or transparent) clause makes the (reverse-) zone bypass unbound's
# filtering of RFC1918 zones.


#----------------------------------------
# Stub Zone urown.net
#----------------------------------------

stub-zone:

    # Name of the stub zone.
    name: 27.172.in-addr.arpa.

    # This option is by default off. If enabled it performs NS set priming,
    # which is similar to root hints, where it starts using the list of
    # nameservers currently published by the zone. Thus, if the hint list is
    # slightly outdated, the resolver picks up a correct list online.
    # Default: no
    #stub-prime: no

    # If enabled, a query is attempted without the stub clause if it fails. The
    # data could not be retrieved and would have caused SERVFAIL because the
    # servers are unreachable, instead it is tried without this clause.
    # Default: no.
    #stub-first: no

    # Enable or disable whether the queries to this stub use SSL for transport.
    # Default: no.
    #stub-ssl-upstream: no

    # IP addresses of stub zone nameservers. Can be IP 4 or IP 6. To use a
    # non-default port for DNS communication append '@' with the port number.

    # Our primary authoritative name server
    stub-addr: 192.0.2.41
    stub-addr: 2001:db8::41
    
    # Our secondary authoritative name server
    stub-addr: 192.0.2.42
    stub-addr: 2001:db8::42

    # Name of stub zone nameserver. Is itself resolved before it isused.
    stub-host: dns1.example.net
    stub-host: dns2.example.net


#=============================================
# Server Settings
#=============================================

server:

    # --------------------------------------------------------------
    # No upstream DNSSEC for 27.172.in-addr.arpa.
    # 172.16.0.0/12 is for use in a private networks (RFC 1918)
    # --------------------------------------------------------------

    # Sets domain name to be insecure, DNSSEC chain of trust is ignored towards
    # the domain name. So a trust anchor above the domain name can not make the
    # domain secure with a DS record, such a DS record is then ignored. Also
    # keys from DLV are ignored for the domain. Can be given multiple times to
    # specify multiple domains that are treated as if unsigned. If you set trust
    # anchors for the domain they override this setting (and the domain is
    # secured).
    #
    # This can be useful if you want to make sure a trust anchor for external
    # lookups does not affect an (unsigned) internal domain. A DS record
    # externally can create validation failures for that internal domain.
    domain-insecure: '27.172.in-addr.arpa.'

    # A DS or DNSKEY RR for a key to use for validation. Multiple entries can be
    # given to specify multiple trusted keys, in addition to the trust-anchor-
    # files. The resource record is entered in the same format as 'dig' or
    # 'drill' prints them, the same format as in the zone file. Has to be on a
    # single line, with "" around it. A TTL can be specified for ease of cut and
    # paste, but is ignored. A class can be specified, but class IN is default.
    trust-anchor: "27.172.in-addr.arpa. DNSKEY 256 3 5 AwEAAa.......xkenu7"

    #--------------------------------------------
    #  Local Reverse DNS Zone for 172.27.0.0/16
    #  27.172.in-addr.arpa
    #--------------------------------------------

    # Used to turn off default contents for AS112 zones. The other types also
    # turn off default contents for the zone. The 'nodefault' option has no
    # other effect than turning off default contents for the given zone. Use
    # 'nodefault' if you use exactly that zone, if you want to use a subzone,
    # use 'transparent'.
    local-zone: "27.172.in-addr.arpa." transparent

    # Allow this domain, and all its subdomains to contain private addresses.
    # Give multiple times to allow multiple domain names to contain private
    # addresses.
    # Default: none.
    private-domain: "27.172.in-addr.arpa."

# -*- mode: ini; indent-tabs-mode: nil; tab-width: 4; -*-
