zone [ ] { type secondary; allow-notify { ; ... }; allow-query { ; ... }; allow-query-on { ; ... }; allow-transfer [ port ] [ transport ] { ; ... }; allow-update-forwarding { ; ... }; also-notify [ port ] [ source ( | * ) ] [ source-v6 ( | * ) ] { ( | [ port ] | [ port ] ) [ key ] [ tls ]; ... }; check-names ( fail | warn | ignore ); checkds ( explicit | ); database ; dialup ( notify | notify-passive | passive | refresh | ); // deprecated dlz ; dnskey-sig-validity ; // obsolete dnssec-dnskey-kskonly ; // obsolete dnssec-loadkeys-interval ; dnssec-policy ; dnssec-update-mode ( maintain | no-resign ); // obsolete file ; forward ( first | only ); forwarders [ port ] [ tls ] { ( | ) [ port ] [ tls ]; ... }; inline-signing ; ixfr-from-differences ; journal ; key-directory ; masterfile-format ( raw | text ); masterfile-style ( full | relative ); max-ixfr-ratio ( unlimited | ); max-journal-size ( default | unlimited | ); max-records ; max-records-per-type ; max-refresh-time ; max-retry-time ; max-transfer-idle-in ; max-transfer-idle-out ; max-transfer-time-in ; max-transfer-time-out ; max-types-per-name ; min-refresh-time ; min-retry-time ; multi-master ; notify ( explicit | master-only | primary-only | ); notify-delay ; notify-source ( | * ); notify-source-v6 ( | * ); notify-to-soa ; nsec3-test-zone ; // test only parental-agents [ port ] [ source ( | * ) ] [ source-v6 ( | * ) ] { ( | [ port ] | [ port ] ) [ key ] [ tls ]; ... }; parental-source ( | * ); parental-source-v6 ( | * ); primaries [ port ] [ source ( | * ) ] [ source-v6 ( | * ) ] { ( | [ port ] | [ port ] ) [ key ] [ tls ]; ... }; request-expire ; request-ixfr ; sig-signing-nodes ; sig-signing-signatures ; sig-signing-type ; sig-validity-interval [ ]; // obsolete transfer-source ( | * ); transfer-source-v6 ( | * ); try-tcp-refresh ; update-check-ksk ; // obsolete zero-no-soa-ttl ; zone-statistics ( full | terse | none | ); };