options {
	query-source address 10.53.0.7;
	notify-source 10.53.0.7;
	transfer-source 10.53.0.7;
	port @PORT@;
	pid-file "named.pid";
	session-keyfile "session.key";
	listen-on { 10.53.0.7; };
	listen-on-v6 { none; };
	recursion no;
	notify yes;
	minimal-responses no;
	dnssec-validation no;
	tkey-gssapi-keytab "dns.keytab";
};

key rndc_key {
	secret "1234abcd8765";
	algorithm @DEFAULT_HMAC@;
};

controls {
	inet 10.53.0.7 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
};

zone "in-addr.arpa" {
	type primary;
	file "in-addr.db";
	update-policy {	grant EXAMPLE.COM krb5-subdomain-self-rhs . PTR; };
};

zone "example.com" {
	type primary;
	file "example.com.db";
	update-policy {
		grant EXAMPLE.COM krb5-self . ANY;
		grant EXAMPLE.COM krb5-subdomain _tcp.example.com SRV;
		grant EXAMPLE.COM krb5-subdomain-self-rhs self-srv.example.com SRV;
		grant EXAMPLE.COM krb5-subdomain-self-rhs self-srv-no-type.example.com;
	};
};
