cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN">

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes

70953fb44a7140fe206c3a5f011e24209c8c5c6abnicholes

16b55a35cff91315d261d1baa776138af465c4e4fuankg<refentry>

16b55a35cff91315d261d1baa776138af465c4e4fuankg<refentryinfo>

16b55a35cff91315d261d1baa776138af465c4e4fuankg<date>Jun 30, 2000</date>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</refentryinfo>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<refmeta>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<refentrytitle>nsupdate</refentrytitle>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<manvolnum>8</manvolnum>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<refmiscinfo>BIND9</refmiscinfo>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</refmeta>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<refnamediv>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<refname>nsupdate</refname>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<refpurpose>Dynamic DNS update utility</refpurpose>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</refnamediv>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<refsynopsisdiv>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<cmdsynopsis>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<command>nsupdate</command>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<arg><option>-d</option></arg>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<group>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes <arg><option>-y <replaceable class="parameter">keyname:secret</replaceable></option></arg>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes <arg><option>-k <replaceable class="parameter">keyfile</replaceable></option></arg>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</group>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<arg><option>-v</option></arg>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<arg>filename</arg>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</cmdsynopsis>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</refsynopsisdiv>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<refsect1>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<title>DESCRIPTION</title>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<para>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<command>nsupdate</command>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesis used to submit Dynamic DNS Update requests as defined in RFC2136

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesto a name server.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesThis allows resource records to be added or removed from a zone

cb2846ded4de1abbb5934b92132baf826f1babfebnicholeswithout manually editing the zone file.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesA single update request can contain requests to add or remove more than one

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesresource record.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</para>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<para>

ac7985784d08a3655291f24f711812b4d8b1cbcffuankgZones that are under dynamic control via

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<command>nsupdate</command>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesor a DHCP server should not be edited by hand.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesManual edits could

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesconflict with dynamic updates and cause data to be lost.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</para>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<para>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesThe resource records that are dynamically added or removed with

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<command>nsupdate</command>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholeshave to be in the same zone.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesRequests are sent to the zone's master server.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesThis is identified by the MNAME field of the zone's SOA record.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</para>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<para>

ac7985784d08a3655291f24f711812b4d8b1cbcffuankgThe

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<option>-d</option>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesoption makes

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<command>nsupdate</command>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesoperate in debug mode.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesThis provides tracing information about the update requests that are

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesmade and the replies received from the name server.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</para>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<para>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesTransaction signatures can be used to authenticate the Dynamic DNS

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesupdates.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesThese use the TSIG resource record type described in RFC2845.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesThe signatures rely on a shared secret that should only be known to

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<command>nsupdate</command>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesand the name server.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesCurrently, the only supported encryption algorithm for TSIG is

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesHMAC-MD5, which is defined in RFC 2104.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesOnce other algorithms are defined for TSIG, applications will need to

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesensure they select the appropriate algorithm as well as the key when

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesauthenticating each other.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesFor instance suitable

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<type>key</type>

ac7985784d08a3655291f24f711812b4d8b1cbcffuankgand

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<type>server</type>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesstatements would be added to

ac7985784d08a3655291f24f711812b4d8b1cbcffuankg<filename>/etc/named.conf</filename>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesso that the name server can associate the appropriate secret key

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesand algorithm with the IP address of the

0a39e7683f6611d66c55712f50bb240428d832a1bnicholesclient application that will be using TSIG authentication.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<command>nsupdate</command>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesdoes not read

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<filename>/etc/named.conf</filename>.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</para>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<para>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<command>nsupdate</command>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesuses the

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<option>-y</option>

ac7985784d08a3655291f24f711812b4d8b1cbcffuankgor

0662ed52e814f8f08ef0e09956413a792584eddffuankg<option>-k</option>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesoption to provide the shared secret needed to generate a TSIG record

ac7985784d08a3655291f24f711812b4d8b1cbcffuankgfor authenticating Dynamic DNS update requests.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesThese options are mutually exclusive.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesWith the

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<option>-k</option>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesoption,

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<command>nsupdate</command>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesreads the shared secret from the file

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<parameter>keyfile</parameter>,

cb2846ded4de1abbb5934b92132baf826f1babfebnicholeswhose name is of the form

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<filename>K{name}.+157.+{random}.private</filename>.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesFor historical

0662ed52e814f8f08ef0e09956413a792584eddffuankgreasons, the file

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<filename>K{name}.+157.+{random}.key</filename>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesmust also be present. When the

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<option>-y</option>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesoption is used, a signature is generated from

0662ed52e814f8f08ef0e09956413a792584eddffuankg<parameter>keyname:secret.</parameter>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<parameter>keyname</parameter>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesis the name of the key,

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesand

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<parameter>secret</parameter>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesis the base64 encoded shared secret.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesUse of the

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<option>-y</option>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesoption is discouraged because the shared secret is supplied as a command

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesline argument in clear text.

0662ed52e814f8f08ef0e09956413a792584eddffuankgThis may be visible in the output from

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<citerefentry>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<refentrytitle>ps</refentrytitle><manvolnum>1

ac7985784d08a3655291f24f711812b4d8b1cbcffuankg</manvolnum>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</citerefentry>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesor in a history file maintained by the user's shell.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</para>

ac7985784d08a3655291f24f711812b4d8b1cbcffuankg<para>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesBy default

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<command>nsupdate</command>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesuses UDP to send update requests to the name server.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesThe

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<option>-v</option>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesoption makes

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<command>nsupdate</command>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesuse a TCP connection.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesThis may be preferable when a batch of update requests is made.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</para>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</refsect1>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<refsect1>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<title>INPUT FORMAT</title>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<para>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<command>nsupdate</command>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesreads input from

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<parameter>filename</parameter>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesor standard input.

bf1e7c075ccc3e6597d17de7641332ff6ff92e8astrikerEach command is supplied on exactly one line of input.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesSome commands are for administrative purposes.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesThe others are either update instructions or prerequisite checks on the

cb2846ded4de1abbb5934b92132baf826f1babfebnicholescontents of the zone.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesThese checks set conditions that some name or set of

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesresource records (RRset) either exists or is absent from the zone.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesThese conditions must be met if the entire update request is to succeed.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesUpdates will be rejected if the tests for the prerequisite conditions fail.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</para>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<para>

ac7985784d08a3655291f24f711812b4d8b1cbcffuankgEvery update request consists of zero or more prerequisites

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesand zero or more updates.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesThis allows a suitably authenticated update request to proceed if some

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesspecified resource records are present or missing from the zone.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesA blank input line causes the accumulated commands to be sent as one Dynamic

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesDNS update request to the name server.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</para>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<para>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesThe command formats and their meaning are as follows:

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<variablelist>

9046ab142ed19505e034af0afb8c15be512b8526bnicholes<varlistentry><term>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<cmdsynopsis>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<command>server</command>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<arg choice="req">servername</arg>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<arg choice="opt">port</arg>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</cmdsynopsis>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</term>

ac7985784d08a3655291f24f711812b4d8b1cbcffuankg<listitem>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<para>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesSends all dynamic update requests to the name server

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<parameter>servername</parameter>.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesWhen no server statement is provided,

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<command>nsupdate</command>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholeswill send updates to the master server of the correct zone.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesThe MNAME field of that zone's SOA record will identify the master

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesserver for that zone.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<parameter>port</parameter>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesis the port number on

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<parameter>servername</parameter>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholeswhere the dynamic update requests get sent.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesIf no port number is specified, the default DNS port number of 53 is

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesused.

8ffac2c334103c0336602aaede650cb578611151fuankg</para>

8ffac2c334103c0336602aaede650cb578611151fuankg

0cb770e9049c8e85ede0bbe3d47904785b15f868fuankg<varlistentry><term>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<cmdsynopsis>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<command>local</command>

ac7985784d08a3655291f24f711812b4d8b1cbcffuankg<arg choice="req">address</arg>

609ef720afd62ca63391c9fdb415cd2faf29aa46bnicholes<arg choice="opt">port</arg>

609ef720afd62ca63391c9fdb415cd2faf29aa46bnicholes</cmdsynopsis>

609ef720afd62ca63391c9fdb415cd2faf29aa46bnicholes</term>

ac7985784d08a3655291f24f711812b4d8b1cbcffuankg<listitem>

609ef720afd62ca63391c9fdb415cd2faf29aa46bnicholes<para>

ac7985784d08a3655291f24f711812b4d8b1cbcffuankgSends all dynamic update requests using the local

ac7985784d08a3655291f24f711812b4d8b1cbcffuankg<parameter>address</parameter>.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesWhen no local statement is provided,

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<command>nsupdate</command>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholeswill send updates using an address and port choosen by the system.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<parameter>port</parameter>

ac7985784d08a3655291f24f711812b4d8b1cbcffuankgcan additionally be used to make requests come from a specific port.

ac7985784d08a3655291f24f711812b4d8b1cbcffuankgIf no port number is specified, the system will assign one.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<varlistentry><term>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<cmdsynopsis>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<command>zone</command>

ac7985784d08a3655291f24f711812b4d8b1cbcffuankg<arg choice="req">zonename</arg>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</cmdsynopsis>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</term>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<listitem>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<para>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesSpecifies that all updates are to be made to the zone

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<parameter>zonename</parameter>.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesIf no

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<parameter>zone</parameter>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesstatement is provided,

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<command>nsupdate</command>

ac7985784d08a3655291f24f711812b4d8b1cbcffuankgwill attempt determine the correct zone to update based on the rest of the input.

0662ed52e814f8f08ef0e09956413a792584eddffuankg</para>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<varlistentry><term>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<cmdsynopsis>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<command>prereq nxdomain</command>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<arg choice="req">domain-name</arg>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</cmdsynopsis>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</term>

8410c53aaf5e0372a19d5f4d2bc696b9c609ce3cbnicholes<listitem>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<para>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholesRequires that no resource record of any type exists with name

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<parameter>domain-name</parameter>.

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</para>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes

0662ed52e814f8f08ef0e09956413a792584eddffuankg<varlistentry><term>

cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<cmdsynopsis>

ac7985784d08a3655291f24f711812b4d8b1cbcffuankg<command>prereq yxdomain</command>

<arg choice="req">domain-name</arg>

</cmdsynopsis>

</term>

<listitem>

<para>

Requires that

<parameter>domain-name</parameter>

exists (has as at least one resource record, of any type).

</para>

<varlistentry><term>

<cmdsynopsis>

<command>prereq nxrrset</command>

<arg choice="req">domain-name</arg>

<arg choice="opt">class</arg>

<arg choice="req">type</arg>

</cmdsynopsis>

</term>

<listitem>

<para>

Requires that no resource record exists of the specified

<parameter>type</parameter>,

<parameter>class</parameter>

and

<parameter>domain-name</parameter>.

If

<parameter>class</parameter>

is omitted, IN (internet) is assumed.

<varlistentry><term>

<cmdsynopsis>

<command>prereq yxrrset</command>

<arg choice="req">domain-name</arg>

<arg choice="opt">class</arg>

<arg choice="req">type</arg>

</cmdsynopsis>

</term>

<listitem>

<para>

This requires that a resource record of the specified

<parameter>type</parameter>,

<parameter>class</parameter>

and

<parameter>domain-name</parameter>

must exist.

If

<parameter>class</parameter>

is omitted, IN (internet) is assumed.

</para>

<varlistentry><term>

<cmdsynopsis>

<command>prereq yxrrset</command>

<arg choice="req">domain-name</arg>

<arg choice="opt">class</arg>

<arg choice="req">type</arg>

<arg choice="req" rep="repeat">data</arg>

</cmdsynopsis>

</term>

<listitem>

<para>

The

<parameter>data</parameter>

from each set of prerequisites of this form

sharing a common

<parameter>type</parameter>,

<parameter>class</parameter>,

and

<parameter>domain-name</parameter>

are combined to form a set of RRs. This set of RRs must

exactly match the set of RRs existing in the zone at the

given

<parameter>type</parameter>,

<parameter>class</parameter>,

and

<parameter>domain-name</parameter>.

The

<parameter>data</parameter>

are written in the standard text representation of the resource record's

RDATA.

</para>

<varlistentry><term>

<cmdsynopsis>

<command>update delete</command>

<arg choice="req">domain-name</arg>

<arg choice="opt">ttl</arg>

<arg choice="opt">class</arg>

<arg choice="opt">type <arg choice="opt" rep="repeat">data</arg></arg>

</cmdsynopsis>

</term>

<listitem>

<para>

Deletes any resource records named

<parameter>domain-name</parameter>.

If

<parameter>type</parameter>

and

<parameter>data</parameter>

is provided, only matching resource records will be removed.

The internet class is assumed if

<parameter>class</parameter>

is not supplied. The

<parameter>ttl</parameter>

is ignored, and is only allowed for compatibility.

</para>

<varlistentry><term>

<cmdsynopsis>

<command>update add</command>

<arg choice="req">domain-name</arg>

<arg choice="req">ttl</arg>

<arg choice="opt">class</arg>

<arg choice="req">type</arg>

<arg choice="req" rep="repeat">data</arg>

</cmdsynopsis>

</term>

<listitem>

<para>

Adds a new resource record with the specified

<parameter>ttl</parameter>,

<parameter>class</parameter>

and

<parameter>data</parameter>.

</para>

</listitem>

</variablelist>

<para>

Lines beginning with a semicolon are comments, and are ignored.

</para>

</refsect1>

<refsect1>

<title>EXAMPLES</title>

<para>

The examples below show how

<command>nsupdate</command>

could be used to insert and delete resource records from the

<type>example.com</type>

zone.

Notice that the input in each example contains a trailing blank line so that

a group of commands are sent as one dynamic update request to the

master name server for

<type>example.com</type>.

<programlisting>

# nsupdate

> update delete oldhost.example.com A

> update add newhost.example.com 86400 A 172.16.1.1

>

</programlisting>

</para>

<para>

Any A records for

<type>oldhost.example.com</type>

are deleted.

and an A record for

<type>newhost.example.com</type>

it IP address 172.16.1.1 is added.

The newly-added record has a 1 day TTL (86400 seconds)

<programlisting>

# nsupdate

> prereq nxdomain nickname.example.com

> update add nickname.example.com CNAME somehost.example.com

>

</programlisting>

</para>

<para>

The prerequisite condition gets the name server to check that there

are no resource records of any type for

<type>nickname.example.com</type>.

If there are, the update request fails.

If this name does not exist, a CNAME for it is added.

This ensures that when the CNAME is added, it cannot conflict with the

long-standing rule in RFC1034 that a name must not exist as any other

record type if it exists as a CNAME.

(The rule has been updated for DNSSEC in RFC2535 to allow CNAMEs to have

SIG, KEY and NXT records.)

</para>

</refsect1>

<refsect1>

<title>FILES</title>

<variablelist>

<varlistentry><term><constant>/etc/resolv.conf</constant></term>

<listitem>

<para>

used to identify default name server

</para>

</listitem>

<varlistentry><term><constant>K{name}.+157.+{random}.key</constant></term>

<listitem>

<para>

base-64 encoding of HMAC-MD5 key created by

<citerefentry>

<refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>

</citerefentry>.

</para>

</listitem>

<varlistentry><term><constant>K{name}.+157.+{random}.private</constant></term>

<listitem>

<para>

base-64 encoding of HMAC-MD5 key created by

<citerefentry>

<refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>

</citerefentry>.

</para>

</listitem>

</variablelist>

</refsect1>

<refsect1>

<title>SEE ALSO</title>

<para>

<citerefentry>

<refentrytitle>RFC2136</refentrytitle>

</citerefentry>,

<citerefentry>

<refentrytitle>RFC2137</refentrytitle>

</citerefentry>,

<citerefentry>

<refentrytitle>RFC2104</refentrytitle>

</citerefentry>,

<citerefentry>

<refentrytitle>RFC2845</refentrytitle>

</citerefentry>,

<citerefentry>

<refentrytitle>RFC1034</refentrytitle>

</citerefentry>,

<citerefentry>

<refentrytitle>RFC2535</refentrytitle>

</citerefentry>,

<citerefentry>

<refentrytitle>named</refentrytitle><manvolnum>8</manvolnum>

</citerefentry>,

<citerefentry>

<refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>

</citerefentry>.

</refsect1>

<refsect1>

<title>BUGS</title>

<para>

The TSIG key is redundantly stored in two separate files.

This is a consequence of nsupdate using the DST library

for its cryptographic operations, and may change in future

releases.

</para>

</refsect1>

</refentry>