The shared secret can be a base64 string or a literal string. Keep the shared secret empty if you want to auto generate a strong key.
+
+
+
Note! You will need to select these TSIG keys for zone transfer in the zone options separately. This DNS server supports hmac-md5, hmac-sha1, hmac-sha256 (recommended), hmac-sha256-128, hmac-sha384, hmac-sha384-192, hmac-sha512, and hmac-sha512-256 algorithms.
+
+
@@ -969,12 +990,21 @@
-
+
-
+
(set 0 to disable)
-
The maximum queries a client can make per minute on average based on the sample size.
+
The maximum queries a client subnet can make per minute on average based on the sample size.
+
+
+
+
+
+
+ (set 0 to disable)
+
+
The maximum queries that generate an error response a client subnet can make per minute on average based on the sample size. Responses with RCODE as FormatError, ServerFailure, or Refused are considered as error responses.
@@ -987,15 +1017,24 @@
-
+
-
- minutes (valid range 1-60; default 1)
+
+ (valid range 0-32; default 24)
-
The interval to sample client query stats.
+
The IPv4 prefix length to define the client subnet.
-
Note! Queries Per Minute (QPM) feature will limit requests from a client based on its IP address. The QPM limit configured will be compared with the average count from the sample size which means a client may exceed the QPM limit for a given minute but won't exceed for the given sample size in minutes. Additionally, any client hitting QPM limit for Refused responses will be automatically blocked for 12 hours.
+
+
+
+
+ (valid range 0-64; default 56)
+
+
The IPv6 prefix length to define the client subnet.
+
+
+
Note! Queries Per Minute (QPM) feature will limit requests from a client subnet based on its IP address and the specified subnet prefix lengths. The QPM limit configured will be compared with the average count from the sample size which means a client may exceed the QPM limit for a given minute but won't exceed for the given sample size in minutes.
The shared secret can be a base64 string or a literal string. Keep the shared secret empty if you want to auto generate a strong key.
-
Note! TSIG allows authenticating requests when at least one key is configured. A secondary zone must be configured with one of the above keys to be able to perform zone transfer. This server supports hmac-md5, hmac-sha1, hmac-sha256 (recommended), hmac-sha256-128, hmac-sha384, hmac-sha384-192, hmac-sha512, and hmac-sha512-256 algorithms.
+
Note! Entering one or more TSIG key names above will cause the DNS server to authenticate all zone transfer requests. A secondary zone must be configured with one of the above keys to be able to perform a zone transfer.