NAMED(8)

📦
version 9.20.30 · 39 versions
, in alpine 3.22, alpine 3.23, alpine 3.24

✨ NAMED(8) ✨

okay bestie, buckle up — this is named, the Internet domain name server, aka the whole reason your WiFi doesn't just vibe into the void 💅

🌸 NAME 🌸

named — Internet domain name server

🎀 SYNOPSIS 🎀

named [ [-4] | [-6] ] [-c config-file] [-C] [-d debug-level] [-D string]
[-E engine-name] [-f] [-g] [-L logfile] [-M option] [-m flag] [-n #cpus]
[-p port] [-s] [-t directory] [-u user] [-v] [-V] ]

🦋 DESCRIPTION 🦋

So named is a Domain Name System (DNS) server — it's literally part of the BIND 9 distribution from ISC. If you wanna know more about the DNS in general, go read RFC 1033 at https://datatracker.ietf.org/doc/html/rfc1033.html, RFC 1034 at https://datatracker.ietf.org/doc/html/rfc1034.html, and RFC 1035 at https://datatracker.ietf.org/doc/html/rfc1035.html. iykyk 📚

When you invoke it with no arguments at all, named reads the default configuration file /etc/bind/named.conf, reads any initial data, and then just... listens for queries. main character energy honestly 👑

💖 OPTIONS 💖

  • -4 — tells named to use only IPv4, even if the host machine is perfectly capable of IPv6. and just so you know, -4 and -6 are mutually exclusive, so pick one, bestie 🫶
  • -6 — tells named to use only IPv6, even if the host machine is perfectly capable of IPv4. same deal: -4 and -6 are mutually exclusive ✨
  • -c config-file — tells named to use config-file as its configuration file instead of the default /etc/bind/named.conf. and listen: to make sure the config file can still be reloaded after the server has changed its working directory (which can happen because of a possible directory option in the config file), config-file should be an absolute pathname. absolute. not vibes-based. 🎯
  • -C — prints out the default built-in configuration and exits.
⚠️ NOTE: this is for debugging purposes only and is not an accurate representation of the actual configuration used by named at runtime. don't be fooled, bestie 🙈
  • -d debug-level — sets the daemon's debug level to debug-level. the more you crank the debug level, the more verbose the debugging traces from named get. it's giving "the volume knob goes to 11" 🔊
  • -D string — specifies a string that's used to identify an instance of named in a process listing. and like... the contents of string are not examined. at all. it's just a name tag 🏷️
  • -E engine-name — when applicable, specifies the hardware to use for cryptographic operations, like a secure key store used for signing. when BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL engine identifier that drives the cryptographic accelerator or hardware service module (usually pkcs11). slay 🔐
  • -f — runs the server in the foreground (i.e., do not daemonize). periodt.
  • -F — turns on FIPS (US Federal Information Processing Standards) mode if the underlying cryptographic library supports running in FIPS mode.
  • -g — runs the server in the foreground and forces all logging to stderr. double duty 💅
  • -L logfile — sets the log to the file logfile by default, instead of the system log.
  • -M option — sets the default (comma-separated) memory context options. the possible flags are:
    • fill: fill blocks of memory with tag values when they're allocated or freed, to assist debugging of memory problems; this is the implicit default if named has been compiled with --enable-developer.
    • nofill: disable the behavior enabled by fill; this is the implicit default unless named has been compiled with --enable-developer.
  • -m flag — turns on memory usage debugging flags. the possible flags are usage, trace and record. these correspond to the ISC_MEM_DEBUGXXXX flags described in <isc/mem.h>. 🧠
  • -n #cpus — creates #cpus worker threads to take advantage of multiple CPUs. if not specified, named tries to determine the number of CPUs present and creates one thread per CPU. and if it can't figure out the number of CPUs? a single worker thread is created. it tried its best 😭
  • -p value — specifies the port(s) on which the server will listen for queries. here's the breakdown, bestie:
    • if value is of the form <portnum> or dns=<portnum>, the server listens for DNS queries on portnum; if not specified, the default is port 53.
    • if value is of the form tls=<portnum>, the server listens for TLS queries on portnum; the default is 853.
    • if value is of the form https=<portnum>, the server listens for HTTPS queries on portnum; the default is 443.
    • if value is of the form http=<portnum>, the server listens for HTTP queries on portnum; the default is 80.

(yes the original says "if not not specified" and honestly? same, girl. anyway, you get it 💀)

  • -s — writes memory usage statistics to stdout on exit.
💡 Note: this option is mainly of interest to BIND 9 developers and may be removed or changed in a future release. so like... don't build your whole personality on it 🫠
  • -t directory — tells named to chroot to directory after processing the command-line arguments, but before reading the configuration file.
🚨 Warning: this option should be used in conjunction with the -u option, because chrooting a process running as root doesn't enhance security on most systems — the way chroot is defined allows a process with root privileges to escape a chroot jail. no cap, that's literally how it works 🔓
  • -U #listeners — this option has been removed. attempts to use it now result in a warning. it's gone, girl, let it go 👋
  • -u user — sets the setuid to user after completing privileged operations, such as creating sockets that listen on privileged ports.
💡 Note: on Linux, named uses the kernel's capability mechanism to drop all root privileges except the ability to bind to a privileged port and set process resource limits. unfortunately, this means the -u option only works when named is run on kernel 2.2.18 or later, or kernel 2.3.99-pre3 or later, since previous kernels did not allow privileges to be retained after setuid. ancient history fr fr 🦕
  • -v — reports the version number and exits.
  • -V — reports the version number, build options, supported cryptographic algorithms, and exits. the full tea ☕
  • -X lock-file — this option has been removed and using it will cause a fatal error. not a warning. a fatal error. do not test her 💀

🌈 SIGNALS 🌈

okay so in routine operation, signals should not be used to control the nameserver — use rndc instead. that's the vibe. 🔮

  • SIGHUP — forces a reload of the server.
  • SIGINT, SIGTERM — shut down the server.

and the result of sending any other signals to the server? undefined. literally undefined. don't do it 🙏

🍓 CONFIGURATION 🍓

the named configuration file is too complex to describe in detail here (iconic, honestly — it said "not in this essay"). a complete description is provided in the BIND 9 Administrator Reference Manual. go read it, bestie 📖

named inherits the umask (file creation mode mask) from the parent process. so if files created by named, such as journal files, need to have custom permissions, the umask should be set explicitly in the script used to start the named process. set it yourself, don't make her guess 💅

🧚 FILES 🧚

  • /etc/bind/named.conf — the default configuration file.
  • /var/run/named.pid — the default process-id file.

⭐ SEE ALSO ⭐

RFC 1033 at https://datatracker.ietf.org/doc/html/rfc1033.html, RFC 1034 at https://datatracker.ietf.org/doc/html/rfc1034.html, RFC 1035 at https://datatracker.ietf.org/doc/html/rfc1035.html, named-checkconf(8), named-checkzone(8), rndc(8), named.conf(5), BIND 9 Administrator Reference Manual. the whole friend group 🫶

👑 Author 👑

Internet Systems Consortium

2026, Internet Systems Consortium

and that's the whole page, bestie! this version is from BIND 9.20.30, dated 2026-10-12 — go forth and resolve some names 💖✨🌸

📦 where this page comes from