address_match_list = 1*address_match_element address_match_element = [ "!" ] (address_match_list / ip_address / ip_prefix / acl_name / "key" key_id) ";"
Address match lists are primarily used to determine access control for
various server operations. They are also used to define priorities
for querying other nameservers and to set the addresses on which
named will listen for queries.
The elements which constitute an address match list can be any
of the following:
Elements can be negated with a leading exclamation mark ("!"), and
the match list names "any", "none", "localhost" and "localnets" are
predefined. More information on those names can be found in the
description of the
The addition of the
clause made the name of this syntactic element something of a
misnomer, since security keys can be used to validate access without
regard to a host or network address. Nonetheless, the term "address
match list" is still used throughout the documentation.
When a given IP address or prefix is compared to an address match
list, the list is traversed in order until an element matches. The
interpretation of a match depends on whether the list is being used
for access control, defining
listen-on ports, or as a
topology, and whether the element was negated.
When used as an access control list, a non-negated match allows
access and a negated match denies access. If there is no match,
access is denied. The clauses
blackhole all use address match lists like this.
option will cause the server to not accept queries on any of the
machine's addresses which do not match the list.
When used with the
topology clause, a non-negated
match returns a distance based on its position on the list (the closer
the match is to the start of the list, the shorter the distance is
between it and the server). A negated match will be assigned the
maximum distance from the server. If there is no match, the address
will get a distance which is further than any non-negated list
element, and closer than any negated element.
Because of the first-match aspect of the algorithm, an element that
defines a subset of another element in the list should come before the
broader element, regardless of whether either is negated. For
1.2.3/24; ! 220.127.116.11; the 18.104.22.168
element is completely useless, because the algorithm will match
any lookup for 22.214.171.124 to the 1.2.3/24 element. Using
! 126.96.36.199; 1.2.3/24 fixes that problem by
having 188.8.131.52 blocked by the negation but all other 1.2.3.* hosts
[ BIND Config. File | BIND Home | ISC ]