dnssec-checkds.html revision 33d0a7767d53cb366039fd0ac4f63cf8a9c351b0
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - Copyright (C) 2012-2016 Internet Systems Consortium, Inc. ("ISC")
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - Permission to use, copy, modify, and/or distribute this software for any
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - purpose with or without fee is hereby granted, provided that the above
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - copyright notice and this permission notice appear in all copies.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - PERFORMANCE OF THIS SOFTWARE.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<a name="man.dnssec-checkds"></a><div class="titlepage"></div>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<p><span class="application">dnssec-checkds</span> — DNSSEC delegation consistency checking tool</p>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<div class="cmdsynopsis"><p><code class="command">dnssec-checkds</code> [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>dig path</code></em></code>] [<code class="option">-D <em class="replaceable"><code>dsfromkey path</code></em></code>] {zone}</p></div>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>dig path</code></em></code>] [<code class="option">-D <em class="replaceable"><code>dsfromkey path</code></em></code>] {zone}</p></div>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<p><span class="command"><strong>dnssec-checkds</strong></span>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync verifies the correctness of Delegation Signer (DS) or DNSSEC
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Lookaside Validation (DLV) resource records for keys in a specified
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync If a <code class="option">file</code> is specified, then the zone is
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync read from that file to find the DNSKEY records. If not,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync then the DNSKEY records for the zone are looked up in the DNS.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Check for a DLV record in the specified lookaside domain,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync instead of checking for a DS record in the zone's parent.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync For example, to check for DLV records for "example.com"
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync in ISC's DLV zone, use:
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>dnssec-checkds -l dlv.isc.org example.com</strong></span>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="term">-d <em class="replaceable"><code>dig path</code></em></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Specifies a path to a <span class="command"><strong>dig</strong></span> binary. Used
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync for testing.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="term">-D <em class="replaceable"><code>dsfromkey path</code></em></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Specifies a path to a <span class="command"><strong>dnssec-dsfromkey</strong></span> binary.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Used for testing.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<p><span class="citerefentry"><span class="refentrytitle">dnssec-dsfromkey</span>(8)</span>,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,