dnssec-verify.docbook revision 42782931073786f98d3d0a617351db40066949a4
f743002678eb67b99bbc29fee116b65d9530fec0wrowe<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
80833bb9a1bf25dcf19e814438a4b311d2e1f4cffuankg "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
a34684a59b60a4173c25035d0c627ef17e6dc215rpluem [<!ENTITY mdash "—">]>
1337c7673efc1f80f634139fbad7cbb98a0dc657ylavic - Copyright (C) 2012, 2014 Internet Systems Consortium, Inc. ("ISC")
1337c7673efc1f80f634139fbad7cbb98a0dc657ylavic - Permission to use, copy, modify, and/or distribute this software for any
4da61833a1cbbca94094f9653fd970582b97a72etrawick - purpose with or without fee is hereby granted, provided that the above
4da61833a1cbbca94094f9653fd970582b97a72etrawick - copyright notice and this permission notice appear in all copies.
4da61833a1cbbca94094f9653fd970582b97a72etrawick - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
4da61833a1cbbca94094f9653fd970582b97a72etrawick - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
4789804be088bcd86ae637a29cdb7fda25169521jailletc - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
4789804be088bcd86ae637a29cdb7fda25169521jailletc - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
4789804be088bcd86ae637a29cdb7fda25169521jailletc - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
4789804be088bcd86ae637a29cdb7fda25169521jailletc - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
e50c3026198fd496f183cda4c32a202925476778covener - PERFORMANCE OF THIS SOFTWARE.
5b88c8507d5ef6d0c4cfbc78230294968175b638minfrin <refentryinfo>
6c3b9cebb551140fbb25d58bae08b539b3802133ylavic </refentryinfo>
4f29b65ab4b547ad5dbe506e2d0ff5d12ead9247ylavic <refentrytitle><application>dnssec-verify</application></refentrytitle>
69301145375a889e7e37caf7cc7321ac0f91801erpluem <refnamediv>
69301145375a889e7e37caf7cc7321ac0f91801erpluem <refname><application>dnssec-verify</application></refname>
69301145375a889e7e37caf7cc7321ac0f91801erpluem <refpurpose>DNSSEC zone verification tool</refpurpose>
506bfe33206b2fece40ef25f695af39dd4130facjkaluza </refnamediv>
506bfe33206b2fece40ef25f695af39dd4130facjkaluza <copyright>
d58a848a016d401b965111e50ef829e1641f7834minfrin <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
2e6f4d654c96c98b761fb012fd25c5d5b1558c44sf </copyright>
2e6f4d654c96c98b761fb012fd25c5d5b1558c44sf </docinfo>
17e6c95f3b22d18acdf8380fb26a8d0e10c80767ylavic <refsynopsisdiv>
17e6c95f3b22d18acdf8380fb26a8d0e10c80767ylavic <cmdsynopsis>
17e6c95f3b22d18acdf8380fb26a8d0e10c80767ylavic <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>
17e6c95f3b22d18acdf8380fb26a8d0e10c80767ylavic <arg><option>-E <replaceable class="parameter">engine</replaceable></option></arg>
e8bd80a4bb88199d2f9a24a50345688e52d9c116ylavic <arg><option>-I <replaceable class="parameter">input-format</replaceable></option></arg>
e8bd80a4bb88199d2f9a24a50345688e52d9c116ylavic <arg><option>-o <replaceable class="parameter">origin</replaceable></option></arg>
e8bd80a4bb88199d2f9a24a50345688e52d9c116ylavic <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
330e16bea8fe9cace4de90c349750c03dfb1fe64ylavic </cmdsynopsis>
330e16bea8fe9cace4de90c349750c03dfb1fe64ylavic </refsynopsisdiv>
d7205b1a86c51c27b71a2c458dc453fd53a261c1covener verifies that a zone is fully signed for each algorithm found
d7205b1a86c51c27b71a2c458dc453fd53a261c1covener in the DNSKEY RRset for the zone, and that the NSEC / NSEC3
44ff304057225e944e220e981d434a046d14cf06covener chains are complete.
44ff304057225e944e220e981d434a046d14cf06covener </refsect1>
032982212dbcc7c3cce95bf89c503bb56e185ac7kbrand <variablelist>
032982212dbcc7c3cce95bf89c503bb56e185ac7kbrand <varlistentry>
032982212dbcc7c3cce95bf89c503bb56e185ac7kbrand <term>-c <replaceable class="parameter">class</replaceable></term>
caad2986f81ab263f7af41467dd622dc9add17f3ylavic Specifies the DNS class of the zone.
caad2986f81ab263f7af41467dd622dc9add17f3ylavic </listitem>
45a10d38e6051fd7bdf9d742aaae633d97ff02abjailletc </varlistentry>
f7317ff316c2b141feea31bddb74d5d3fa1584edjorton <varlistentry>
2165214331e4afafca4048f66f303d0253d7b001covener <term>-E <replaceable class="parameter">engine</replaceable></term>
1e2d421a36999d292042a5539971070d54aa6c63ylavic Specifies the cryptographic hardware to use, when applicable.
fa7ed98b9dc94c5845cf845aea0a44ecacd290c9humbedooh When BIND is built with OpenSSL PKCS#11 support, this defaults
fa7ed98b9dc94c5845cf845aea0a44ecacd290c9humbedooh to the string "pkcs11", which identifies an OpenSSL engine
fa7ed98b9dc94c5845cf845aea0a44ecacd290c9humbedooh that can drive a cryptographic accelerator or hardware service
0b67eb8568cd58bb77082703951679b42cf098actrawick module. When BIND is built with native PKCS#11 cryptography
0b67eb8568cd58bb77082703951679b42cf098actrawick (--enable-native-pkcs11), it defaults to the path of the PKCS#11
0b67eb8568cd58bb77082703951679b42cf098actrawick provider library specified via "--with-pkcs11".
5ef3c61605a3a021ff71f488983cb0065f8e1a79covener </listitem>
fb1985a97912b25ec6564c73e610a31e5fc6e25fcovener </varlistentry>
6502b7b32f980cc2093bb3ebce37e5e4dc68fba4ylavic <varlistentry>
6502b7b32f980cc2093bb3ebce37e5e4dc68fba4ylavic <term>-I <replaceable class="parameter">input-format</replaceable></term>
c1a63b8fad09c419c1a64f75993feb8a343a6801ylavic The format of the input zone file.
c1a63b8fad09c419c1a64f75993feb8a343a6801ylavic Possible formats are <command>"text"</command> (default)
e6b4bd1113567627ab6bb6c6a7105e1e01a7d889jailletc This option is primarily intended to be used for dynamic
e466c40e1801982602ee0200c9e8b61cc148742djailletc signed zones so that the dumped zone file in a non-text
e466c40e1801982602ee0200c9e8b61cc148742djailletc format containing updates can be verified independently.
457468b82e59d01eba00dd9d0817309c8f5e414ejim The use of this option does not make much sense for
457468b82e59d01eba00dd9d0817309c8f5e414ejim non-dynamic zones.
04983e3bd1754764eec7d6bb772fe3b0bf391771jorton </listitem>
04983e3bd1754764eec7d6bb772fe3b0bf391771jorton </varlistentry>
15660979a30d251681463de2e0584853890082accovener <varlistentry>
15660979a30d251681463de2e0584853890082accovener <term>-o <replaceable class="parameter">origin</replaceable></term>
cfd9415521847b2f9394fad04fb701cfb955f503rjung The zone origin. If not specified, the name of the zone file
cfd9415521847b2f9394fad04fb701cfb955f503rjung is assumed to be the origin.
28c31fb73c1264bd1d0ff932573677030b024c7dwrowe </listitem>
28c31fb73c1264bd1d0ff932573677030b024c7dwrowe </varlistentry>
28c31fb73c1264bd1d0ff932573677030b024c7dwrowe <varlistentry>
28c31fb73c1264bd1d0ff932573677030b024c7dwrowe <term>-v <replaceable class="parameter">level</replaceable></term>
63b9f1f5880391261705f696d7d65507bbe9ace3covener Sets the debugging level.
49dacedb6c387b786b7911082ff35121a45f414bcovener </listitem>
49dacedb6c387b786b7911082ff35121a45f414bcovener </varlistentry>
49dacedb6c387b786b7911082ff35121a45f414bcovener <varlistentry>
3c990331fc6702119e4f5b8ba9eae3021aea5265jim <listitem>
3c990331fc6702119e4f5b8ba9eae3021aea5265jim Prints version information.
fc42512879dd0504532f52fe5d0d0383dda96a1eniq </listitem>
fc42512879dd0504532f52fe5d0d0383dda96a1eniq </varlistentry>
0451df5dc50fa5d8b3e07d92ee6a92e36a1181a5niq <varlistentry>
da0442c0440caef34706e2c2f3af05cb65921cc0jailletc Only verify that the DNSKEY RRset is signed with key-signing
da0442c0440caef34706e2c2f3af05cb65921cc0jailletc keys. Without this flag, it is assumed that the DNSKEY RRset
06b8f183140c8e02e0974e938a05078b511d1603covener will be signed by all active keys. When this flag is set,
06b8f183140c8e02e0974e938a05078b511d1603covener it will not be an error if the DNSKEY RRset is not signed
06b8f183140c8e02e0974e938a05078b511d1603covener by zone-signing keys. This corresponds to the <option>-x</option>
259878293a997ff49f5ddfc53d3739cbdc25444ecovener </listitem>
259878293a997ff49f5ddfc53d3739cbdc25444ecovener </varlistentry>
15890c9306ba98f6fc243e15a3c4778ddc7d773erpluem <varlistentry>
65967d05f839dbf27cf91d91fa79585eeae19660minfrin Ignore the KSK flag on the keys when determining whether
65967d05f839dbf27cf91d91fa79585eeae19660minfrin the zone if correctly signed. Without this flag it is
65967d05f839dbf27cf91d91fa79585eeae19660minfrin assumed that there will be a non-revoked, self-signed
65967d05f839dbf27cf91d91fa79585eeae19660minfrin DNSKEY with the KSK flag set for each algorithm and
8152945ae46857b170cb227e79bb799f4fc7710dminfrin that RRsets other than DNSKEY RRset will be signed with
8152945ae46857b170cb227e79bb799f4fc7710dminfrin a different DNSKEY without the KSK flag set.
75f5c2db254c0167a0e396254460de09b775d203trawick With this flag set, we only require that for each algorithm,
75f5c2db254c0167a0e396254460de09b775d203trawick there will be at least one non-revoked, self-signed DNSKEY,
75f5c2db254c0167a0e396254460de09b775d203trawick regardless of the KSK flag state, and that other RRsets
4f0358189bfa57b8e75bd6b94db264302a8f336amrumph will be signed by a non-revoked key for the same algorithm
4f0358189bfa57b8e75bd6b94db264302a8f336amrumph that includes the self-signed key; the same key may be used
4f0358189bfa57b8e75bd6b94db264302a8f336amrumph for both purposes. This corresponds to the <option>-z</option>
5716f9c6daa92dde5f2f9d11ed63f7c9549c223atrawick </listitem>
5716f9c6daa92dde5f2f9d11ed63f7c9549c223atrawick </varlistentry>
54d750a84a175d8e338880514d440773eb986b50covener <varlistentry>
54d750a84a175d8e338880514d440773eb986b50covener The file containing the zone to be signed.
54d750a84a175d8e338880514d440773eb986b50covener </listitem>
7a3aa12f0eda24793ee26d6a179bd53132e9dae8covener </varlistentry>
54d750a84a175d8e338880514d440773eb986b50covener </variablelist>
83b50288fa7d306324bba68832011ea08f5c7832covener </refsect1>
5f066f496cd9f20a2a701255bc67d44e7cb46daetrawick <citerefentry>
2e15620d724fb8e3a5be183b917359a2fd6e9468covener <refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
2e15620d724fb8e3a5be183b917359a2fd6e9468covener </citerefentry>,
2e15620d724fb8e3a5be183b917359a2fd6e9468covener <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
1b988c41ee505962781d110a3e4c2c90f1ea0aa4covener </refsect1>
b8efdc95bec9cf089aa1be0bfd07d46aa1137a7acovener <para><corpauthor>Internet Systems Consortium</corpauthor>
f06e7c4b1bce6b6491e5de0b7998d3f5696b293dchrisd </refsect1>
179565be4043d7e5f9161aa75271fa0a001866d9covener - Local variables:
179565be4043d7e5f9161aa75271fa0a001866d9covener - mode: sgml