    zone string [ class ] {
    	type ( master | primary );
    	allow-query { address_match_element; ... };
    	allow-query-on { address_match_element; ... };
    	allow-transfer { address_match_element; ... };
    	allow-update { address_match_element; ... };
    	also-notify [ port integer ] [ dscp integer ] { ( masters | ipv4_address [ port integer ] | ipv6_address [ port integer ] ) [ key string ]; ... };
    	alt-transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [ dscp integer ];
    	alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ] [ dscp integer ];
    	auto-dnssec ( allow | maintain | off );
    	check-dup-records ( fail | warn | ignore );
    	check-integrity boolean;
    	check-mx ( fail | warn | ignore );
    	check-mx-cname ( fail | warn | ignore );
    	check-names ( fail | warn | ignore );
    	check-sibling boolean;
    	check-spf ( warn | ignore );
    	check-srv-cname ( fail | warn | ignore );
    	check-wildcard boolean;
    	database string;
    	dialup ( notify | notify-passive | passive | refresh | boolean );
    	dlz string;
    	dnssec-dnskey-kskonly boolean;
    	dnssec-loadkeys-interval integer;
    	dnssec-secure-to-insecure boolean;
    	dnssec-update-mode ( maintain | no-resign );
    	file quoted_string;
    	forward ( first | only );
    	forwarders [ port integer ] [ dscp integer ] { ( ipv4_address | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
    	inline-signing boolean;
    	ixfr-from-differences boolean;
    	journal quoted_string;
    	key-directory quoted_string;
    	masterfile-format ( map | raw | text );
    	masterfile-style ( full | relative );
    	max-journal-size ( unlimited | sizeval );
    	max-records integer;
    	max-transfer-idle-out integer;
    	max-transfer-time-out integer;
    	max-zone-ttl ( unlimited | ttlval );
    	notify ( explicit | master-only | boolean );
    	notify-delay integer;
    	notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [ dscp integer ];
    	notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ] [ dscp integer ];
    	notify-to-soa boolean;
    	serial-update-method ( date | increment | unixtime );
    	sig-signing-nodes integer;
    	sig-signing-signatures integer;
    	sig-signing-type integer;
    	sig-validity-interval integer [ integer ];
    	update-check-ksk boolean;
    	update-policy ( local | { ( deny | grant ) string ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ string ] rrtypelist; ... };
    	zero-no-soa-ttl boolean;
    	zone-statistics ( full | terse | none | boolean );
    };