options {
	query-source address 10.53.0.1;
	notify-source 10.53.0.1;
	transfer-source 10.53.0.1;
	port @PORT@;
	pid-file "named.pid";
	listen-on { 10.53.0.1; };
	listen-on-v6 { none; };
	allow-transfer { any; };
	recursion no;
	dnssec-validation no;
	allow-new-zones yes;
};

{% include "_common/controls.conf.j2" %}

dnssec-policy "common" {
	offline-ksk yes;
	keys {
		ksk lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
		zsk lifetime P6M algorithm @DEFAULT_ALGORITHM@;
	};
};

dnssec-policy "csk" {
	offline-ksk no;
	keys {
		csk lifetime P6M algorithm @DEFAULT_ALGORITHM@;
	};
};

dnssec-policy "unlimited" {
	offline-ksk yes;
	keys {
		ksk lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
		zsk lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
	};
};

dnssec-policy "no-cdnskey" {
	offline-ksk yes;
	keys {
		ksk lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
		zsk lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
	};
	cdnskey no;
	cds-digest-types { SHA-1; SHA-256; SHA-384; };
};

dnssec-policy "no-cds" {
	offline-ksk yes;
	keys {
		ksk lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
		zsk lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
	};
	cds-digest-types { };
};

dnssec-policy "two-tone" {
	offline-ksk yes;
	keys {
		ksk lifetime unlimited algorithm @ALTERNATIVE_ALGORITHM@;
		zsk lifetime P5M algorithm @ALTERNATIVE_ALGORITHM@;
		ksk lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
		zsk lifetime P3M algorithm @DEFAULT_ALGORITHM@;
	};
};

dnssec-policy "ksk-roll" {
	offline-ksk yes;
	keys {
		ksk lifetime P6M algorithm @DEFAULT_ALGORITHM@;
		zsk lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
	};
};

dnssec-policy "fast" {
	offline-ksk yes;
	keys {
		ksk lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
		zsk lifetime 8792 algorithm @DEFAULT_ALGORITHM@;
	};
        dnskey-ttl 439;
        max-zone-ttl 4396;
        zone-propagation-delay 439;
        signatures-validity 6;
        signatures-validity-dnskey 6;
        signatures-refresh 2;
        signatures-jitter 0;
        publish-safety 1;
        retire-safety 1;
        parent-ds-ttl 5;
        parent-propagation-delay 5;
};

dnssec-policy "invalid-skr" {
	offline-ksk yes;
	keys {
		ksk lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
		zsk lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
	};
};

zone "invalid-skr.test" {
	type primary;
	file "invalid-skr.test.db";
	dnssec-policy "invalid-skr";
};
