BIND Configuration File Guide--Address Match Lists


address_match_list = 1*address_match_element address_match_element = [ "!" ] (ip_address / ip_prefix / acl_name / address_match_list) ";"

Definition and Usage

Address match lists are lists of elements. The elements can be any of the following:

The ACLs "any", "none", "localhost" and "localnets" are predefined. More information can be found in the description of the acl statement.

Elements can be negated with a leading "!".

When a given IP address or prefix is compared to an address match list, the list is traversed in order and the first match (regardless of negation) is used. The interpretation of a match depends on whether the list is being used for access control or as a topology.

When used as an access control list, a non-negated match allows access and a negated match denies access. If there is no match, access is denied. The clauses allow-query, allow-transfer and allow-update all use address match lists like this. Similarly, the listen-on clause can use negation to define local addresses which should not be used to accept nameserver connections.

When used with the topology clause, a non-negated match returns a distance based on its postion on the list (the closer the match is to the start of the list, the shorter the distance is between it and the server). A negated match will be assigned the maximum distance from the server. If there is no match, the address will get a distance which is further than any non-negated list element, and closer than any negated element.

Because of the first-match aspect of the algorithm, an element that defines a subset of another element in the list should come before the broader element, regardless of whether either is negated. For example, in 1.2.3/24; !; the element is completely useless, because the algorithm will match any lookup for to the 1.2.3/24 element. Using !; 1.2.3/24 fixes that problem by having blocked by the negation but all other 1.2.3.* hosts fall through.

[ BIND Config. File | BIND Home | ISC ]

Steven J. Richardson <>
Last Updated: $Id: address_list.html,v 1.4 1997/05/06 22:11:29 vixie Exp $