named.conf.options

options {
    // This is the working directory of the server. Any non-absolute pathnames
    // in the configuration files are taken as relative to this directory.
    directory "/var/cache/bind";

    // Remove (hide) our bind version - no reason to disclose it.
    version "";

    // Configure the IPs to listen on here.
    listen-on    { any; };
    listen-on-v6 { none; };  // Docker usually don't have IPv6 enabled.

    // If you want to allow only specific hosts to use the DNS server, or allow
    // anyone to send queries.
    allow-query { any; };

    // Specify a list of IPs/masks to allow zone transfers to here.
    //
    // You can override this on a per-zone basis by specifying this inside a
    // zone block.
    //
    // Warning: Removing this block will cause BIND to revert to its default
    //          behaviour of allowing zone transfers to any host (!).
    allow-transfer { none; };

    // IP addresses to upstream DNS servers we will query for any domains we
    // are not authoritative for.
    forwarders {
        1.1.1.1;
        208.67.222.222;
    };

    // Use the downloaded bind.keys file when validating signed zones.
    dnssec-validation yes;
};