dnssec-checkds.docbook revision 30eec077db2bdcb6f2a0dc388a3cdde2ede75ec1
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill - Copyright (C) 2012-2015 Internet Systems Consortium, Inc. ("ISC")
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill - Permission to use, copy, modify, and/or distribute this software for any
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill - purpose with or without fee is hereby granted, provided that the above
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill - copyright notice and this permission notice appear in all copies.
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill - PERFORMANCE OF THIS SOFTWARE.
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill<!-- Converted by db4-upgrade version 1.0 -->
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-checkds">
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <refentryinfo>
28e4da25922bdfc5cba7ab29f47de911bbd78009Matthew Ahrens <corpauthor>Internet Systems Consortium, Inc.</corpauthor>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill </refentryinfo>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <refentrytitle><application>dnssec-checkds</application></refentrytitle>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <refname><application>dnssec-checkds</application></refname>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <refpurpose>A DNSSEC delegation consistency checking tool.</refpurpose>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill </refnamediv>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <refsynopsisdiv>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <arg choice="opt" rep="norepeat"><option>-d <replaceable class="parameter">dig path</replaceable></option></arg>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">dsfromkey path</replaceable></option></arg>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill </cmdsynopsis>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <arg choice="opt" rep="norepeat"><option>-d <replaceable class="parameter">dig path</replaceable></option></arg>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">dsfromkey path</replaceable></option></arg>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill </cmdsynopsis>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill </refsynopsisdiv>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <refsection><info><title>DESCRIPTION</title></info>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill verifies the correctness of Delegation Signer (DS) or DNSSEC
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill Lookaside Validation (DLV) resource records for keys in a specified
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill </refsection>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <refsection><info><title>OPTIONS</title></info>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <variablelist>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <varlistentry>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <term>-f <replaceable class="parameter">file</replaceable></term>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill If a <option>file</option> is specified, then the zone is
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill read from that file to find the DNSKEY records. If not,
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill then the DNSKEY records for the zone are looked up in the DNS.
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill </varlistentry>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <varlistentry>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <term>-l <replaceable class="parameter">domain</replaceable></term>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill Check for a DLV record in the specified lookaside domain,
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill instead of checking for a DS record in the zone's parent.
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill For example, to check for DLV records for "example.com"
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill in ISC's DLV zone, use:
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <command>dnssec-checkds -l dlv.isc.org example.com</command>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill </varlistentry>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <varlistentry>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <term>-d <replaceable class="parameter">dig path</replaceable></term>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill Specifies a path to a <command>dig</command> binary. Used
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill </varlistentry>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <varlistentry>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <term>-D <replaceable class="parameter">dsfromkey path</replaceable></term>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill Specifies a path to a <command>dnssec-dsfromkey</command> binary.
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill Used for testing.
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill </varlistentry>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill </variablelist>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill </refsection>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <refsection><info><title>SEE ALSO</title></info>
c9a6ea2e938727c95af7108c5e00eee4c890c7aeBryan Cantrill <refentrytitle>dnssec-dsfromkey</refentrytitle><manvolnum>8</manvolnum>
28e4da25922bdfc5cba7ab29f47de911bbd78009Matthew Ahrens </citerefentry>,
28e4da25922bdfc5cba7ab29f47de911bbd78009Matthew Ahrens <citerefentry>
28e4da25922bdfc5cba7ab29f47de911bbd78009Matthew Ahrens <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
28e4da25922bdfc5cba7ab29f47de911bbd78009Matthew Ahrens </citerefentry>,
28e4da25922bdfc5cba7ab29f47de911bbd78009Matthew Ahrens <citerefentry>
28e4da25922bdfc5cba7ab29f47de911bbd78009Matthew Ahrens <refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
28e4da25922bdfc5cba7ab29f47de911bbd78009Matthew Ahrens </citerefentry>,
28e4da25922bdfc5cba7ab29f47de911bbd78009Matthew Ahrens </refsection>