// /etc/bind/named.conf.options

acl "trusted" {
	172.16.1.0/24;
	localhost;
	localnets;
};

// DNS servery v siti
acl "server" {
	172.16.1.20/32;
	172.16.1.150/32;
};

options {
	directory "/var/cache/bind";

	// DNS keytab ze Samby
	tkey-gssapi-keytab "/usr/local/samba/bind-dns/dns.keytab";

	allow-query { trusted; };
        allow-recursion { trusted; };
        allow-query-cache { trusted; };
	allow-update { trusted; };
	allow-transfer { server; };

	// primarni DNS v siti
	forwarders {
		172.16.1.150;
	};

	dnssec-validation auto;

	auth-nxdomain no;
	listen-on { 172.16.1.20; };
};