c2bc56dc65b4b103a5600565680eb5f33fa4c90bMark Andrews<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"

c2bc56dc65b4b103a5600565680eb5f33fa4c90bMark Andrews "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"

c2bc56dc65b4b103a5600565680eb5f33fa4c90bMark Andrews [<!ENTITY mdash "&#8212;">]>

<refentry id="man.dnssec-checkds">

<refentryinfo>

<date>April 11, 2012</date>

</refentryinfo>

<refmeta>

<refentrytitle><application>dnssec-checkds</application></refentrytitle>

<manvolnum>8</manvolnum>

<refmiscinfo>BIND9</refmiscinfo>

</refmeta>

<refnamediv>

<refname><application>dnssec-checkds</application></refname>

<refpurpose>A DNSSEC delegation consistency checking tool.</refpurpose>

</refnamediv>

<docinfo>

<copyright>

<year>2012</year>

<holder>Internet Systems Consortium, Inc. ("ISC")</holder>

</copyright>

</docinfo>

<refsynopsisdiv>

<cmdsynopsis>

<command>dnssec-checkds</command>

<arg><option>-l <replaceable class="parameter">domain</replaceable></option></arg>

<arg><option>-f <replaceable class="parameter">file</replaceable></option></arg>

<arg><option>-d <replaceable class="parameter">dig path</replaceable></option></arg>

<arg><option>-D <replaceable class="parameter">dsfromkey path</replaceable></option></arg>

<arg choice="req">zone</arg>

</cmdsynopsis>

<cmdsynopsis>

<command>dnssec-dsfromkey</command>

<arg><option>-l <replaceable class="parameter">domain</replaceable></option></arg>

<arg><option>-f <replaceable class="parameter">file</replaceable></option></arg>

<arg><option>-d <replaceable class="parameter">dig path</replaceable></option></arg>

<arg><option>-D <replaceable class="parameter">dsfromkey path</replaceable></option></arg>

<arg choice="req">zone</arg>

</cmdsynopsis>

</refsynopsisdiv>

<refsect1>

<title>DESCRIPTION</title>

<para><command>dnssec-checkds</command>

verifies the correctness of Delegation Signer (DS) or DNSSEC

Lookaside Validation (DLV) resource records for keys in a specified

zone.

</para>

</refsect1>

<refsect1>

<title>OPTIONS</title>

<variablelist>

<varlistentry>

<term>-f <replaceable class="parameter">file</replaceable></term>

<listitem>

<para>

If a <option>file</option> is specified, then the zone is

read from that file to find the DNSKEY records. If not,

then the DNSKEY records for the zone are looked up in the DNS.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-l <replaceable class="parameter">domain</replaceable></term>

<listitem>

<para>

Check for a DLV record in the specified lookaside domain,

instead of checking for a DS record in the zone's parent.

For example, to check for DLV records for "example.com"

in ISC's DLV zone, use:

<command>dnssec-checkds -l dlv.isc.org example.com</command>

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-d <replaceable class="parameter">dig path</replaceable></term>

<listitem>

<para>

Specifies a path to a <command>dig</command> binary. Used

for testing.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-D <replaceable class="parameter">dsfromkey path</replaceable></term>

<listitem>

<para>

Specifies a path to a <command>dnssec-dsfromkey</command> binary.

Used for testing.

</para>

</listitem>

</varlistentry>

</variablelist>

</refsect1>

<refsect1>

<title>SEE ALSO</title>

<para><citerefentry>

<refentrytitle>dnssec-dsfromkey</refentrytitle><manvolnum>8</manvolnum>

</citerefentry>,

<citerefentry>

<refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>

</citerefentry>,

<citerefentry>

<refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>

</citerefentry>,

</para>

</refsect1>

<refsect1>

<title>AUTHOR</title>

<para><corpauthor>Internet Systems Consortium</corpauthor>

</para>

</refsect1>

</refentry><!--