// NS11


{% set managed_key = managed_key | default(False) %}
{% set accept_expired = accept_expired | default(False) %}
{% set multi_view = multi_view | default(False) %}

options {
	query-source address 10.53.0.4;
	notify-source 10.53.0.4;
	transfer-source 10.53.0.4;
	port @PORT@;
	pid-file "named.pid";
	listen-on { 10.53.0.4; };
	listen-on-v6 { none; };
	minimal-any no;
	minimal-responses no;
	recursion yes;

	{% if accept_expired %}
		dnssec-accept-expired yes;
	{% endif %}

	{% if managed_key %}
		dnssec-validation auto;
	{% else %}
		dnssec-validation yes;
	{% endif %}

	disable-algorithms "digest-alg-unsupported.example." { ECDSAP384SHA384; };
	disable-ds-digests "digest-alg-unsupported.example." { "SHA384"; "SHA-384"; };
	disable-ds-digests "ds-unsupported.example." { "SHA256"; "SHA-256"; "SHA384"; "SHA-384"; };
	disable-algorithms "badalg.secure.example." { ECDSAP256SHA256; };
	disable-algorithms "z.secure.example." { ECDSAP256SHA256; };
	disable-algorithms "ent.secure.example." { ECDSAP256SHA256; };
};

{% if not managed_key %}
include "trusted.conf";
{% endif %}

{% include "_common/controls.conf.j2" %}

{% if multi_view %}
	view rec {
		match-recursive-only yes;
		recursion yes;
		dnssec-accept-expired yes;
		minimal-responses no;
		dnssec-validation yes;

		include "trusted.conf";

		zone "." {
			type hint;
			file "../../_common/root.hint";
		};

		zone secure.example {
			type static-stub;
			server-addresses { 10.53.0.4; };
		};

		zone insecure.secure.example {
			type static-stub;
			server-addresses { 10.53.0.4; };
		};
	};

	view auth {
		recursion no;
		allow-recursion { none; };
		dnssec-validation no;

		zone "." {
			type hint;
			file "../../_common/root.hint";
		};

		zone secure.example {
			type secondary;
			primaries { 10.53.0.3; };
		};

		zone insecure.secure.example {
			type secondary;
			primaries { 10.53.0.2; };
		};
	};
{% else %}
	zone "." {
		type hint;
		file "../../_common/root.hint";
	};
{% endif %}
