a134177ed9f82189504191d90f3ed9e97c2b47cbTinderbox User - Copyright (C) 2012-2017 Internet Systems Consortium, Inc. ("ISC")
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews - This Source Code Form is subject to the terms of the Mozilla Public
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews - License, v. 2.0. If a copy of the MPL was not distributed with this
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews - file, You can obtain one at http://mozilla.org/MPL/2.0/.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<!-- Converted by db4-upgrade version 1.0 -->
83a28ca274521e15086fc39febde507bcc4e145eMark Andrews<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-checkds">
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews <refentryinfo>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <corpauthor>Internet Systems Consortium, Inc.</corpauthor>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews </refentryinfo>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews <refentrytitle><application>dnssec-checkds</application></refentrytitle>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews <refnamediv>
b79fc6723bc9896ad6eb79e1bed1f9b37c4915ebMark Andrews <refname><application>dnssec-checkds</application></refname>
f02194c0538094556090ded7964df2b72771d85eJeremy C. Reed <refpurpose>DNSSEC delegation consistency checking tool</refpurpose>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews </refnamediv>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews </copyright>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews <refsynopsisdiv>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="opt" rep="norepeat"><option>-d <replaceable class="parameter">dig path</replaceable></option></arg>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">dsfromkey path</replaceable></option></arg>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews </cmdsynopsis>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="opt" rep="norepeat"><option>-d <replaceable class="parameter">dig path</replaceable></option></arg>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">dsfromkey path</replaceable></option></arg>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews </cmdsynopsis>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews </refsynopsisdiv>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <refsection><info><title>DESCRIPTION</title></info>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews verifies the correctness of Delegation Signer (DS) or DNSSEC
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews Lookaside Validation (DLV) resource records for keys in a specified
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt </refsection>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews <variablelist>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews <varlistentry>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews <term>-f <replaceable class="parameter">file</replaceable></term>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews If a <option>file</option> is specified, then the zone is
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews read from that file to find the DNSKEY records. If not,
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews then the DNSKEY records for the zone are looked up in the DNS.
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews </varlistentry>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews <varlistentry>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews <term>-l <replaceable class="parameter">domain</replaceable></term>
30eec077db2bdcb6f2a0dc388a3cdde2ede75ec1Mark Andrews Check for a DLV record in the specified lookaside domain,
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews instead of checking for a DS record in the zone's parent.
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews </varlistentry>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews <varlistentry>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews <term>-d <replaceable class="parameter">dig path</replaceable></term>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews Specifies a path to a <command>dig</command> binary. Used
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews for testing.
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews </varlistentry>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews <varlistentry>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews <term>-D <replaceable class="parameter">dsfromkey path</replaceable></term>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews Specifies a path to a <command>dnssec-dsfromkey</command> binary.
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews Used for testing.
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews </varlistentry>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews </variablelist>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt </refsection>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews <refentrytitle>dnssec-dsfromkey</refentrytitle><manvolnum>8</manvolnum>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews </citerefentry>,
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews <citerefentry>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews </citerefentry>,
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews <citerefentry>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews <refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
1cefb9df3fa34d08734f29005cfafa6be5cf3e93Mark Andrews </citerefentry>,
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt </refsection>