bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa<!DOCTYPE book [

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa<!ENTITY mdash "&#8212;">]>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.delv">

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <info>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <date>2014-04-23</date>

0fefa32a0a32ce300e3a436457f19a04c1ca07f7Eugen Kuksa </info>

e3ed0ae47dd551ddd9d74c33fff11b19a23a1d97Eugen Kuksa <refentryinfo>

e3ed0ae47dd551ddd9d74c33fff11b19a23a1d97Eugen Kuksa <corpname>ISC</corpname>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <corpauthor>Internet Systems Consortium, Inc.</corpauthor>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </refentryinfo>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <refmeta>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <refentrytitle>delv</refentrytitle>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <manvolnum>1</manvolnum>

037be4e5b0e867dd148db2ea89640d8edf009053Eugen Kuksa <refmiscinfo>BIND9</refmiscinfo>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa </refmeta>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa <refnamediv>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa <refname>delv</refname>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa <refpurpose>DNS lookup and validation utility</refpurpose>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa </refnamediv>

037be4e5b0e867dd148db2ea89640d8edf009053Eugen Kuksa

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa <docinfo>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa <copyright>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <year>2014</year>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <year>2015</year>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <holder>Internet Systems Consortium, Inc. ("ISC")</holder>

9a4b469ca0a7f44a598e551a973c75195207db58Eugen Kuksa </copyright>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </docinfo>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa

93796f5bd8317f475737d26cb21781ce4c65a47cEugen Kuksa <refsynopsisdiv>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <cmdsynopsis sepchar=" ">

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <command>delv</command>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <arg choice="opt" rep="norepeat">@server</arg>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <arg choice="opt" rep="norepeat"><option>-4</option></arg>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <arg choice="opt" rep="norepeat"><option>-6</option></arg>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <arg choice="opt" rep="norepeat"><option>-a <replaceable class="parameter">anchor-file</replaceable></option></arg>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <arg choice="opt" rep="norepeat"><option>-b <replaceable class="parameter">address</replaceable></option></arg>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <arg choice="opt" rep="norepeat"><option>-d <replaceable class="parameter">level</replaceable></option></arg>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <arg choice="opt" rep="norepeat"><option>-i</option></arg>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <arg choice="opt" rep="norepeat"><option>-m</option></arg>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <arg choice="opt" rep="norepeat"><option>-p <replaceable class="parameter">port#</replaceable></option></arg>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <arg choice="opt" rep="norepeat"><option>-q <replaceable class="parameter">name</replaceable></option></arg>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">type</replaceable></option></arg>

2de19644821c7d76aa76403754f21046f5519db0Eugen Kuksa <arg choice="opt" rep="norepeat"><option>-x <replaceable class="parameter">addr</replaceable></option></arg>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <arg choice="opt" rep="norepeat">name</arg>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <arg choice="opt" rep="norepeat">type</arg>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <arg choice="opt" rep="norepeat">class</arg>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <arg choice="opt" rep="repeat">queryopt</arg>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </cmdsynopsis>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <cmdsynopsis sepchar=" ">

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <command>delv</command>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <arg choice="opt" rep="norepeat"><option>-h</option></arg>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </cmdsynopsis>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <cmdsynopsis sepchar=" ">

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <command>delv</command>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <arg choice="opt" rep="norepeat"><option>-v</option></arg>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </cmdsynopsis>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <cmdsynopsis sepchar=" ">

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <command>delv</command>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <arg choice="opt" rep="repeat">queryopt</arg>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <arg choice="opt" rep="repeat">query</arg>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </cmdsynopsis>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </refsynopsisdiv>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <refsection><info><title>DESCRIPTION</title></info>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <para><command>delv</command>

2de19644821c7d76aa76403754f21046f5519db0Eugen Kuksa (Domain Entity Lookup &amp; Validation) is a tool for sending

2de19644821c7d76aa76403754f21046f5519db0Eugen Kuksa DNS queries and validating the results, using the same internal

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa resolver and validator logic as <command>named</command>.

2de19644821c7d76aa76403754f21046f5519db0Eugen Kuksa </para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <command>delv</command> will send to a specified name server all

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa queries needed to fetch and validate the requested data; this

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa includes the original requested query, subsequent queries to follow

0fefa32a0a32ce300e3a436457f19a04c1ca07f7Eugen Kuksa CNAME or DNAME chains, and queries for DNSKEY, DS and DLV records

0fefa32a0a32ce300e3a436457f19a04c1ca07f7Eugen Kuksa to establish a chain of trust for DNSSEC validation.

2de19644821c7d76aa76403754f21046f5519db0Eugen Kuksa It does not perform iterative resolution, but simulates the

0fefa32a0a32ce300e3a436457f19a04c1ca07f7Eugen Kuksa behavior of a name server configured for DNSSEC validating and

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa forwarding.

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa By default, responses are validated using built-in DNSSEC trust

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa anchors for the root zone (".") and for the ISC DNSSEC lookaside

0fefa32a0a32ce300e3a436457f19a04c1ca07f7Eugen Kuksa validation zone ("dlv.isc.org"). Records returned by

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <command>delv</command> are either fully validated or

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa were not signed. If validation fails, an explanation of

0fefa32a0a32ce300e3a436457f19a04c1ca07f7Eugen Kuksa the failure is included in the output; the validation process

0fefa32a0a32ce300e3a436457f19a04c1ca07f7Eugen Kuksa can be traced in detail. Because <command>delv</command> does

0fefa32a0a32ce300e3a436457f19a04c1ca07f7Eugen Kuksa not rely on an external server to carry out validation, it can

0fefa32a0a32ce300e3a436457f19a04c1ca07f7Eugen Kuksa be used to check the validity of DNS responses in environments

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa where local name servers may not be trustworthy.

2de19644821c7d76aa76403754f21046f5519db0Eugen Kuksa </para>

2de19644821c7d76aa76403754f21046f5519db0Eugen Kuksa <para>

2de19644821c7d76aa76403754f21046f5519db0Eugen Kuksa Unless it is told to query a specific name server,

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <command>delv</command> will try each of the servers listed in

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <filename>/etc/resolv.conf</filename>. If no usable server

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa addresses are found, <command>delv</command> will send

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa queries to the localhost addresses (127.0.0.1 for IPv4, ::1

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa for IPv6).

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa When no command line arguments or options are given,

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <command>delv</command> will perform an NS query for "."

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa (the root zone).

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </refsection>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <refsection><info><title>SIMPLE USAGE</title></info>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa A typical invocation of <command>delv</command> looks like:

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <programlisting> delv @server name type </programlisting>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa where:

2de19644821c7d76aa76403754f21046f5519db0Eugen Kuksa

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <variablelist>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <varlistentry>

2de19644821c7d76aa76403754f21046f5519db0Eugen Kuksa <term><constant>server</constant></term>

2de19644821c7d76aa76403754f21046f5519db0Eugen Kuksa <listitem>

2de19644821c7d76aa76403754f21046f5519db0Eugen Kuksa <para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa is the name or IP address of the name server to query. This

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa can be an IPv4 address in dotted-decimal notation or an IPv6

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa address in colon-delimited notation. When the supplied

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <parameter>server</parameter> argument is a hostname,

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <command>delv</command> resolves that name before

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa querying that name server (note, however, that this

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa initial lookup is <emphasis>not</emphasis> validated

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa by DNSSEC).

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa If no <parameter>server</parameter> argument is

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa provided, <command>delv</command> consults

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <filename>/etc/resolv.conf</filename>; if an

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa address is found there, it queries the name server at

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa that address. If either of the <option>-4</option> or

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <option>-6</option> options are in use, then

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa only addresses for the corresponding transport

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa will be tried. If no usable addresses are found,

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <command>delv</command> will send queries to

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa the localhost addresses (127.0.0.1 for IPv4,

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa ::1 for IPv6).

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa </para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </listitem>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </varlistentry>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa <varlistentry>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <term><constant>name</constant></term>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa <listitem>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa is the domain name to be looked up.

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa </para>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa </listitem>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </varlistentry>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa <varlistentry>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa <term><constant>type</constant></term>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <listitem>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <para>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa indicates what type of query is required &mdash;

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa ANY, A, MX, etc.

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <parameter>type</parameter> can be any valid query

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa type. If no

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <parameter>type</parameter> argument is supplied,

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <command>delv</command> will perform a lookup for an

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa A record.

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </listitem>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </varlistentry>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </variablelist>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa </refsection>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <refsection><info><title>OPTIONS</title></info>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <variablelist>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <varlistentry>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <term>-a <replaceable class="parameter">anchor-file</replaceable></term>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <listitem>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa <para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa Specifies a file from which to read DNSSEC trust anchors.

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa The default is <filename>/etc/bind.keys</filename>, which

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa is included with <acronym>BIND</acronym> 9 and contains

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa trust anchors for the root zone (".") and for the ISC

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa DNSSEC lookaside validation zone ("dlv.isc.org").

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </para>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa <para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa Keys that do not match the root or DLV trust-anchor

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa names are ignored; these key names can be overridden

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa using the <option>+dlv=NAME</option> or

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <option>+root=NAME</option> options.

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </para>

9a4b469ca0a7f44a598e551a973c75195207db58Eugen Kuksa <para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa Note: When reading the trust anchor file,

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <command>delv</command> treats <option>managed-keys</option>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa statements and <option>trusted-keys</option> statements

2c10bceb28a74fc291959697e023f22a66753655Eugen Kuksa identically. That is, for a managed key, it is the

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <emphasis>initial</emphasis> key that is trusted; RFC 5011

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa key management is not supported. <command>delv</command>

2c10bceb28a74fc291959697e023f22a66753655Eugen Kuksa will not consult the managed-keys database maintained by

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <command>named</command>. This means that if either of the

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa keys in <filename>/etc/bind.keys</filename> is revoked

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa and rolled over, it will be necessary to update

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <filename>/etc/bind.keys</filename> to use DNSSEC

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa validation in <command>delv</command>.

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </listitem>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </varlistentry>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <varlistentry>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <term>-b <replaceable class="parameter">address</replaceable></term>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <listitem>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa Sets the source IP address of the query to

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa <parameter>address</parameter>. This must be a valid address

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa on one of the host's network interfaces or "0.0.0.0" or "::".

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa An optional source port may be specified by appending

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa "#&lt;port&gt;"

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </listitem>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </varlistentry>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <varlistentry>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <term>-c <replaceable class="parameter">class</replaceable></term>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <listitem>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa Sets the query class for the requested data. Currently,

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa only class "IN" is supported in <command>delv</command>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa and any other value is ignored.

9a4b469ca0a7f44a598e551a973c75195207db58Eugen Kuksa </para>

9a4b469ca0a7f44a598e551a973c75195207db58Eugen Kuksa </listitem>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </varlistentry>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <varlistentry>

9a4b469ca0a7f44a598e551a973c75195207db58Eugen Kuksa <term>-d <replaceable class="parameter">level</replaceable></term>

9a4b469ca0a7f44a598e551a973c75195207db58Eugen Kuksa <listitem>

9a4b469ca0a7f44a598e551a973c75195207db58Eugen Kuksa <para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa Set the systemwide debug level to <option>level</option>.

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa The allowed range is from 0 to 99.

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa The default is 0 (no debugging).

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa Debugging traces from <command>delv</command> become

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa more verbose as the debug level increases.

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa See the <option>+mtrace</option>, <option>+rtrace</option>,

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa and <option>+vtrace</option> options below for additional

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa debugging details.

0fefa32a0a32ce300e3a436457f19a04c1ca07f7Eugen Kuksa </para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </listitem>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa </varlistentry>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <varlistentry>

2de19644821c7d76aa76403754f21046f5519db0Eugen Kuksa <term>-h</term>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <listitem>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa <para>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa Display the <command>delv</command> help usage output and exit.

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </para>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa </listitem>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </varlistentry>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa <varlistentry>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa <term>-i</term>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa <listitem>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa <para>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa Insecure mode. This disables internal DNSSEC validation.

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa (Note, however, this does not set the CD bit on upstream

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa queries. If the server being queried is performing DNSSEC

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa validation, then it will not return invalid data; this

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa can cause <command>delv</command> to time out. When it

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa is necessary to examine invalid data to debug a DNSSEC

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa problem, use <command>dig +cd</command>.)

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </listitem>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </varlistentry>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa <varlistentry>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <term>-m</term>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <listitem>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <para>

2c10bceb28a74fc291959697e023f22a66753655Eugen Kuksa Enables memory usage debugging.

2de19644821c7d76aa76403754f21046f5519db0Eugen Kuksa </para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </listitem>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa </varlistentry>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa

9a4b469ca0a7f44a598e551a973c75195207db58Eugen Kuksa <varlistentry>

2de19644821c7d76aa76403754f21046f5519db0Eugen Kuksa <term>-p <replaceable class="parameter">port#</replaceable></term>

9a4b469ca0a7f44a598e551a973c75195207db58Eugen Kuksa <listitem>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa <para>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa Specifies a destination port to use for queries instead of

9a4b469ca0a7f44a598e551a973c75195207db58Eugen Kuksa the standard DNS port number 53. This option would be used

9a4b469ca0a7f44a598e551a973c75195207db58Eugen Kuksa with a name server that has been configured to listen

9a4b469ca0a7f44a598e551a973c75195207db58Eugen Kuksa for queries on a non-standard port number.

9a4b469ca0a7f44a598e551a973c75195207db58Eugen Kuksa </para>

9a4b469ca0a7f44a598e551a973c75195207db58Eugen Kuksa </listitem>

9a4b469ca0a7f44a598e551a973c75195207db58Eugen Kuksa </varlistentry>

9a4b469ca0a7f44a598e551a973c75195207db58Eugen Kuksa

9a4b469ca0a7f44a598e551a973c75195207db58Eugen Kuksa <varlistentry>

9a4b469ca0a7f44a598e551a973c75195207db58Eugen Kuksa <term>-q <replaceable class="parameter">name</replaceable></term>

9a4b469ca0a7f44a598e551a973c75195207db58Eugen Kuksa <listitem>

2c10bceb28a74fc291959697e023f22a66753655Eugen Kuksa <para>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa Sets the query name to <parameter>name</parameter>.

cba0aeea95db26960d4d2e5a1dd571f17a5b7ae4Eugen Kuksa While the query name can be specified without using the

cba0aeea95db26960d4d2e5a1dd571f17a5b7ae4Eugen Kuksa <option>-q</option>, it is sometimes necessary to disambiguate

cba0aeea95db26960d4d2e5a1dd571f17a5b7ae4Eugen Kuksa names from types or classes (for example, when looking up the

cba0aeea95db26960d4d2e5a1dd571f17a5b7ae4Eugen Kuksa name "ns", which could be misinterpreted as the type NS,

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa or "ch", which could be misinterpreted as class CH).

8247c2f9606497ccfc5b4d10b3fcb07d8c0f6074Eugen Kuksa </para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </listitem>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </varlistentry>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa

08e520eb8e9947de926d733c48a13249c857f570Eugen Kuksa <varlistentry>

08e520eb8e9947de926d733c48a13249c857f570Eugen Kuksa <term>-t <replaceable class="parameter">type</replaceable></term>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <listitem>

037be4e5b0e867dd148db2ea89640d8edf009053Eugen Kuksa <para>

037be4e5b0e867dd148db2ea89640d8edf009053Eugen Kuksa Sets the query type to <parameter>type</parameter>, which

037be4e5b0e867dd148db2ea89640d8edf009053Eugen Kuksa can be any valid query type supported in BIND 9 except

037be4e5b0e867dd148db2ea89640d8edf009053Eugen Kuksa for zone transfer types AXFR and IXFR. As with

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <option>-q</option>, this is useful to distinguish

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa query name type or class when they are ambiguous.

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa it is sometimes necessary to disambiguate names from types.

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <para>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa The default query type is "A", unless the <option>-x</option>

2cff1039d6c94285eb5bf4f0147eef4ce9b944f1Eugen Kuksa option is supplied to indicate a reverse lookup, in which case

2cff1039d6c94285eb5bf4f0147eef4ce9b944f1Eugen Kuksa it is "PTR".

2de19644821c7d76aa76403754f21046f5519db0Eugen Kuksa </para>

2cff1039d6c94285eb5bf4f0147eef4ce9b944f1Eugen Kuksa </listitem>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa </varlistentry>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <varlistentry>

bdbe06eab641ea31682220252b728d421e4c028eEugen Kuksa <term>-v</term>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa <listitem>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa <para>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa Print the <command>delv</command> version and exit.

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa </para>

037be4e5b0e867dd148db2ea89640d8edf009053Eugen Kuksa </listitem>

531ab01db5b35eee69a73572d0443c75a4cbc1b0Eugen Kuksa </varlistentry>

531ab01db5b35eee69a73572d0443c75a4cbc1b0Eugen Kuksa

531ab01db5b35eee69a73572d0443c75a4cbc1b0Eugen Kuksa <varlistentry>

531ab01db5b35eee69a73572d0443c75a4cbc1b0Eugen Kuksa <term>-x <replaceable class="parameter">addr</replaceable></term>

531ab01db5b35eee69a73572d0443c75a4cbc1b0Eugen Kuksa <listitem>

531ab01db5b35eee69a73572d0443c75a4cbc1b0Eugen Kuksa <para>

037be4e5b0e867dd148db2ea89640d8edf009053Eugen Kuksa Performs a reverse lookup, mapping an addresses to

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa a name. <parameter>addr</parameter> is an IPv4 address in

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa dotted-decimal notation, or a colon-delimited IPv6 address.

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa When <option>-x</option> is used, there is no need to provide

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa the <parameter>name</parameter> or <parameter>type</parameter>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa arguments. <command>delv</command> automatically performs a

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa lookup for a name like <literal>11.12.13.10.in-addr.arpa</literal>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa and sets the query type to PTR. IPv6 addresses are looked up

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa using nibble format under the IP6.ARPA domain.

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa </para>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa </listitem>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa </varlistentry>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa <varlistentry>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa <term>-4</term>

08e520eb8e9947de926d733c48a13249c857f570Eugen Kuksa <listitem>

d5206f4c00e0ab064bc49a19cad9740781940689Eugen Kuksa <para>

99a1bfbb82c875580410b4745617fea2297fdc2bEugen Kuksa Forces <command>delv</command> to only use IPv4.

cba0aeea95db26960d4d2e5a1dd571f17a5b7ae4Eugen Kuksa </para>

cba0aeea95db26960d4d2e5a1dd571f17a5b7ae4Eugen Kuksa </listitem>

cba0aeea95db26960d4d2e5a1dd571f17a5b7ae4Eugen Kuksa </varlistentry>

cba0aeea95db26960d4d2e5a1dd571f17a5b7ae4Eugen Kuksa

cba0aeea95db26960d4d2e5a1dd571f17a5b7ae4Eugen Kuksa <varlistentry>

cba0aeea95db26960d4d2e5a1dd571f17a5b7ae4Eugen Kuksa <term>-6</term>

cba0aeea95db26960d4d2e5a1dd571f17a5b7ae4Eugen Kuksa <listitem>

cba0aeea95db26960d4d2e5a1dd571f17a5b7ae4Eugen Kuksa <para>

cba0aeea95db26960d4d2e5a1dd571f17a5b7ae4Eugen Kuksa Forces <command>delv</command> to only use IPv6.

cba0aeea95db26960d4d2e5a1dd571f17a5b7ae4Eugen Kuksa </para>

cba0aeea95db26960d4d2e5a1dd571f17a5b7ae4Eugen Kuksa </listitem>

cba0aeea95db26960d4d2e5a1dd571f17a5b7ae4Eugen Kuksa </varlistentry>

</variablelist>

</refsection>

<refsection><info><title>QUERY OPTIONS</title></info>

<para><command>delv</command>

provides a number of query options which affect the way results are

displayed, and in some cases the way lookups are performed.

</para>

<para>

Each query option is identified by a keyword preceded by a plus sign

(<literal>+</literal>). Some keywords set or reset an

option. These may be preceded by the string

<literal>no</literal> to negate the meaning of that keyword.

Other keywords assign values to options like the timeout interval.

They have the form <option>+keyword=value</option>.

The query options are:

<variablelist>

<varlistentry>

<term><option>+[no]cdflag</option></term>

<listitem>

<para>

Controls whether to set the CD (checking disabled) bit in

queries sent by <command>delv</command>. This may be useful

when troubleshooting DNSSEC problems from behind a validating

resolver. A validating resolver will block invalid responses,

making it difficult to retrieve them for analysis. Setting

the CD flag on queries will cause the resolver to return

invalid responses, which <command>delv</command> can then

validate internally and report the errors in detail.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><option>+[no]class</option></term>

<listitem>

<para>

Controls whether to display the CLASS when printing

a record. The default is to display the CLASS.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><option>+[no]ttl</option></term>

<listitem>

<para>

Controls whether to display the TTL when printing

a record. The default is to display the TTL.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><option>+[no]rtrace</option></term>

<listitem>

<para>

Toggle resolver fetch logging. This reports the

name and type of each query sent by <command>delv</command>

in the process of carrying out the resolution and validation

process: this includes including the original query and

all subsequent queries to follow CNAMEs and to establish a

chain of trust for DNSSEC validation.

</para>

<para>

This is equivalent to setting the debug level to 1 in

the "resolver" logging category. Setting the systemwide

debug level to 1 using the <option>-d</option> option will

product the same output (but will affect other logging

categories as well).

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><option>+[no]mtrace</option></term>

<listitem>

<para>

Toggle message logging. This produces a detailed dump of

the responses received by <command>delv</command> in the

process of carrying out the resolution and validation process.

</para>

<para>

This is equivalent to setting the debug level to 10

for the "packets" module of the "resolver" logging

category. Setting the systemwide debug level to 10 using

the <option>-d</option> option will produce the same output

(but will affect other logging categories as well).

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><option>+[no]vtrace</option></term>

<listitem>

<para>

Toggle validation logging. This shows the internal

process of the validator as it determines whether an

answer is validly signed, unsigned, or invalid.

</para>

<para>

This is equivalent to setting the debug level to 3

for the "validator" module of the "dnssec" logging

category. Setting the systemwide debug level to 3 using

the <option>-d</option> option will produce the same output

(but will affect other logging categories as well).

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><option>+[no]short</option></term>

<listitem>

<para>

Provide a terse answer. The default is to print the answer in a

verbose form.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><option>+[no]comments</option></term>

<listitem>

<para>

Toggle the display of comment lines in the output. The default

is to print comments.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><option>+[no]rrcomments</option></term>

<listitem>

<para>

Toggle the display of per-record comments in the output (for

example, human-readable key information about DNSKEY records).

The default is to print per-record comments.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><option>+[no]crypto</option></term>

<listitem>

<para>

Toggle the display of cryptographic fields in DNSSEC records.

The contents of these field are unnecessary to debug most DNSSEC

validation failures and removing them makes it easier to see

the common failures. The default is to display the fields.

When omitted they are replaced by the string "[omitted]" or

in the DNSKEY case the key id is displayed as the replacement,

e.g. "[ key id = value ]".

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><option>+[no]trust</option></term>

<listitem>

<para>

Controls whether to display the trust level when printing

a record. The default is to display the trust level.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><option>+[no]split[=W]</option></term>

<listitem>

<para>

Split long hex- or base64-formatted fields in resource

records into chunks of <parameter>W</parameter> characters

(where <parameter>W</parameter> is rounded up to the nearest

multiple of 4).

<parameter>+nosplit</parameter> or

<parameter>+split=0</parameter> causes fields not to be

split at all. The default is 56 characters, or 44 characters

when multiline mode is active.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><option>+[no]all</option></term>

<listitem>

<para>

Set or clear the display options

<option>+[no]comments</option>,

<option>+[no]rrcomments</option>, and

<option>+[no]trust</option> as a group.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><option>+[no]multiline</option></term>

<listitem>

<para>

Print long records (such as RRSIG, DNSKEY, and SOA records)

in a verbose multi-line format with human-readable comments.

The default is to print each record on a single line, to

facilitate machine parsing of the <command>delv</command>

output.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><option>+[no]dnssec</option></term>

<listitem>

<para>

Indicates whether to display RRSIG records in the

<command>delv</command> output. The default is to

do so. Note that (unlike in <command>dig</command>)

this does <emphasis>not</emphasis> control whether to

request DNSSEC records or whether to validate them.

DNSSEC records are always requested, and validation

will always occur unless suppressed by the use of

<option>-i</option> or <option>+noroot</option> and

<option>+nodlv</option>.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><option>+[no]root[=ROOT]</option></term>

<listitem>

<para>

Indicates whether to perform conventional (non-lookaside)

DNSSEC validation, and if so, specifies the

name of a trust anchor. The default is to validate using

a trust anchor of "." (the root zone), for which there is

a built-in key. If specifying a different trust anchor,

then <option>-a</option> must be used to specify a file

containing the key.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><option>+[no]dlv[=DLV]</option></term>

<listitem>

<para>

Indicates whether to perform DNSSEC lookaside validation,

and if so, specifies the name of the DLV trust anchor.

The default is to perform lookaside validation using

a trust anchor of "dlv.isc.org", for which there is a

built-in key. If specifying a different name, then

<option>-a</option> must be used to specify a file

containing the DLV key.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><option>+[no]tcp</option></term>

<listitem>

<para>

Controls whether to use TCP when sending queries.

The default is to use UDP unless a truncated

response has been received.

</para>

</listitem>

</varlistentry>

</variablelist>

</para>

</refsection>

<refsection><info><title>FILES</title></info>

<para><filename>/etc/bind.keys</filename></para>

<para><filename>/etc/resolv.conf</filename></para>

</refsection>

<refsection><info><title>SEE ALSO</title></info>

<para><citerefentry>

<refentrytitle>dig</refentrytitle><manvolnum>1</manvolnum>

</citerefentry>,

<citerefentry>

<refentrytitle>named</refentrytitle><manvolnum>8</manvolnum>

</citerefentry>,

<citetitle>RFC4034</citetitle>,

<citetitle>RFC4035</citetitle>,

<citetitle>RFC4431</citetitle>,

<citetitle>RFC5074</citetitle>,

<citetitle>RFC5155</citetitle>.

</para>

</refsection>

</refentry>