options {
	query-source address 10.53.0.1;
	notify-source 10.53.0.1;
	transfer-source 10.53.0.1;
	port @PORT@;
	pid-file "named.pid";
	session-keyfile "session.key";
	listen-on { 10.53.0.1; 127.0.0.1; };
	listen-on-v6 { none; };
	recursion no;
	dnssec-validation no;
	notify yes;
	tkey-gssapi-keytab "dns.keytab";
};

{% include "_common/controls.conf.j2" %}

zone "example.nil." IN {
	type primary;
	file "example.nil.db";

{% raw %}
	update-policy {
		grant Administrator@EXAMPLE.NIL wildcard * A AAAA SRV CNAME;
		grant testdenied@EXAMPLE.NIL wildcard * TXT;
		grant "local:auth.sock" external * CNAME;
	};
{% endraw %}

	/* we need to use check-names ignore so _msdcs A records can be created */
	check-names ignore;
};
