rndc.docbook revision 8927a982bde7e4b665966b55f0fa57c5cf21b9d8
55e5c51e661e23e24573db84114a3837817745c9Evan Hunt - Copyright (C) 2004, 2005, 2007, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
55e5c51e661e23e24573db84114a3837817745c9Evan Hunt - Copyright (C) 2000, 2001 Internet Software Consortium.
62d63e5f02a5e7fcda59cf361149e3d7c78477beEvan Hunt - Permission to use, copy, modify, and/or distribute this software for any
62d63e5f02a5e7fcda59cf361149e3d7c78477beEvan Hunt - purpose with or without fee is hereby granted, provided that the above
62d63e5f02a5e7fcda59cf361149e3d7c78477beEvan Hunt - copyright notice and this permission notice appear in all copies.
df925e6c66d45d960fbac0383169763967d2111cEvan Hunt - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
df925e6c66d45d960fbac0383169763967d2111cEvan Hunt - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
a81ae06ed3081753a73e7638919673be57eaf47fEvan Hunt - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
a81ae06ed3081753a73e7638919673be57eaf47fEvan Hunt - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
a81ae06ed3081753a73e7638919673be57eaf47fEvan Hunt - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
2425d8bb7ccf5dc956ad12d64d97b5a42e022930Evan Hunt - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
2425d8bb7ccf5dc956ad12d64d97b5a42e022930Evan Hunt - PERFORMANCE OF THIS SOFTWARE.
740e7340c55e9f0cf80c6fbbf7e8d3c1bdeaa255Mark Andrews<!-- Converted by db4-upgrade version 1.0 -->
740e7340c55e9f0cf80c6fbbf7e8d3c1bdeaa255Mark Andrews<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.rndc">
3c7df84b2019e454f6333ca354ef709f6451a2abMark Andrews <refentryinfo>
c9297d37593b36de9978c122dbeaf1bb7ae8d19dMark Andrews <corpauthor>Internet Systems Consortium, Inc.</corpauthor>
c9297d37593b36de9978c122dbeaf1bb7ae8d19dMark Andrews </refentryinfo>
0b8bd3a4ae3efd91f88e8901323faf99b5b06136Evan Hunt <refentrytitle><application>rndc</application></refentrytitle>
b748b5e2c2fa40f758e3b35ad4f1fde99ab5e11fEvan Hunt <refnamediv>
b748b5e2c2fa40f758e3b35ad4f1fde99ab5e11fEvan Hunt <refname><application>rndc</application></refname>
8d21efc150998f9643f98ce5a4f0b17460e12043Evan Hunt <refpurpose>name server control utility</refpurpose>
8d21efc150998f9643f98ce5a4f0b17460e12043Evan Hunt </refnamediv>
9c9b75c43566058727cb89204d36977559cb99afMark Andrews <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
9c9b75c43566058727cb89204d36977559cb99afMark Andrews </copyright>
6225380ca6dd045302fd5cb22d1dbbe6a88a7509Evan Hunt <refsynopsisdiv>
c9611b45736af157e2993c6ef852e55e8e24ca83Evan Hunt <arg choice="opt" rep="norepeat"><option>-b <replaceable class="parameter">source-address</replaceable></option></arg>
c91c439f80c555f016cce8e9fd910630f81bb5c9Curtis Blackburn <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">config-file</replaceable></option></arg>
ffff5d67926821d3db8df63bdd84a9cb1ce56739Evan Hunt <arg choice="opt" rep="norepeat"><option>-k <replaceable class="parameter">key-file</replaceable></option></arg>
ffff5d67926821d3db8df63bdd84a9cb1ce56739Evan Hunt <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">server</replaceable></option></arg>
ffff5d67926821d3db8df63bdd84a9cb1ce56739Evan Hunt <arg choice="opt" rep="norepeat"><option>-p <replaceable class="parameter">port</replaceable></option></arg>
9a0dd99a757c469d9530acd5cb11789b3b0af5ceEvan Hunt <arg choice="opt" rep="norepeat"><option>-q</option></arg>
9a0dd99a757c469d9530acd5cb11789b3b0af5ceEvan Hunt <arg choice="opt" rep="norepeat"><option>-r</option></arg>
9a0dd99a757c469d9530acd5cb11789b3b0af5ceEvan Hunt <arg choice="opt" rep="norepeat"><option>-V</option></arg>
9a0dd99a757c469d9530acd5cb11789b3b0af5ceEvan Hunt <arg choice="opt" rep="norepeat"><option>-y <replaceable class="parameter">key_id</replaceable></option></arg>
641e87a1a0ee716f46b4d0f529e73b58f19aee4eEvan Hunt </cmdsynopsis>
641e87a1a0ee716f46b4d0f529e73b58f19aee4eEvan Hunt </refsynopsisdiv>
2154c019124246199c7fe494b86860461c8a5f40Evan Hunt <refsection><info><title>DESCRIPTION</title></info>
214836c18496e0d2630df1cda5eeee13c38b9068Evan Hunt controls the operation of a name
214836c18496e0d2630df1cda5eeee13c38b9068Evan Hunt server. It supersedes the <command>ndc</command> utility
214836c18496e0d2630df1cda5eeee13c38b9068Evan Hunt that was provided in old BIND releases. If
43d84798fac5cfeeecf9431ef848a9ffdcf0d86fEvan Hunt <command>rndc</command> is invoked with no command line
43d84798fac5cfeeecf9431ef848a9ffdcf0d86fEvan Hunt options or arguments, it prints a short summary of the
43d84798fac5cfeeecf9431ef848a9ffdcf0d86fEvan Hunt supported commands and the available options and their
3806133da574f4570db3005473e0d56b746cc6eaEvan Hunt communicates with the name server over a TCP connection, sending
71f8edccba553c4ed4988dd12ac877564e4987d1Evan Hunt commands authenticated with digital signatures. In the current
71f8edccba553c4ed4988dd12ac877564e4987d1Evan Hunt <command>rndc</command> and <command>named</command>,
c8803902d6e740d1ed85e099835813466fa51391Curtis Blackburn the only supported authentication algorithms are HMAC-MD5
b3d116c299722ed7b27550744fff789a61ad3d2bEvan Hunt (for compatibility), HMAC-SHA1, HMAC-SHA224, HMAC-SHA256
b3d116c299722ed7b27550744fff789a61ad3d2bEvan Hunt (default), HMAC-SHA384 and HMAC-SHA512.
b3d116c299722ed7b27550744fff789a61ad3d2bEvan Hunt They use a shared secret on each end of the connection.
99394e9807411cbbeb9814b603c7dfa3b569388eMark Andrews This provides TSIG-style authentication for the command
99394e9807411cbbeb9814b603c7dfa3b569388eMark Andrews request and the name server's response. All commands sent
dc6cea0448ea7b10eb1ae7d38bfc18544a4dfb97Evan Hunt over the channel must be signed by a key_id known to the
54ca2413348024c6d03904c01486c952c3d4a3bcEvan Hunt reads a configuration file to
54ca2413348024c6d03904c01486c952c3d4a3bcEvan Hunt determine how to contact the name server and decide what
54ca2413348024c6d03904c01486c952c3d4a3bcEvan Hunt algorithm and key it should use.
48019314431389cca5f8eba7ee9aa5bc08a67f4eMark Andrews </refsection>
48019314431389cca5f8eba7ee9aa5bc08a67f4eMark Andrews <refsection><info><title>OPTIONS</title></info>
578e3196076b409c509c6c0a0873e7bfe54f4d61Evan Hunt <variablelist>
578e3196076b409c509c6c0a0873e7bfe54f4d61Evan Hunt <varlistentry>
578e3196076b409c509c6c0a0873e7bfe54f4d61Evan Hunt <term>-b <replaceable class="parameter">source-address</replaceable></term>
c07c2a862e0f9d671e2961cd179c7b28d7b04f10Mark Andrews Use <replaceable class="parameter">source-address</replaceable>
f1c1aab2c9e720399d66d8db5f40515d47c45ecfMark Andrews as the source address for the connection to the server.
f1c1aab2c9e720399d66d8db5f40515d47c45ecfMark Andrews Multiple instances are permitted to allow setting of both
a6b0db81c82ab3528d19137b08d1cb3f8ed06a52Evan Hunt the IPv4 and IPv6 source addresses.
24798afb6e0fa969cf9f6d3b91d1545410853bb8Mark Andrews </varlistentry>
aa24128022b85c49f59ad45a3c81ad124d645530Mark Andrews <varlistentry>
fc0bfa07c7b7aff70cf75e9414167e1f2d532845Mark Andrews <term>-c <replaceable class="parameter">config-file</replaceable></term>
cdf252d6b84dd160dbf37b22845d54d6e4b1732dMark Andrews Use <replaceable class="parameter">config-file</replaceable>
c9cecf7bb509b1c860d0b6deba7fccd85b9feb68Mark Andrews as the configuration file instead of the default,
25b95d31ce658326510bef979cf2909c6eddc428Mark Andrews </varlistentry>
25b95d31ce658326510bef979cf2909c6eddc428Mark Andrews <varlistentry>
e285c6ea84312a7be807b3af30151444b0002ba6Mark Andrews <term>-k <replaceable class="parameter">key-file</replaceable></term>
e285c6ea84312a7be807b3af30151444b0002ba6Mark Andrews Use <replaceable class="parameter">key-file</replaceable>
222d38735f97f771054e223b03f84c5858252332Evan Hunt as the key file instead of the default,
222d38735f97f771054e223b03f84c5858252332Evan Hunt <filename>/etc/rndc.key</filename> will be used to
0277a7d6c19ab116b6832076ab9d850e1bf112d3Mark Andrews authenticate
0277a7d6c19ab116b6832076ab9d850e1bf112d3Mark Andrews commands sent to the server if the <replaceable class="parameter">config-file</replaceable>
2dd959aa18d0f661efb0d9646963993a4773d036Evan Hunt does not exist.
8bd5bcd2a786dfd501a39008be79187e77735e45Mark Andrews </varlistentry>
3ad3e9c948fd8781d0343b19f0412f5bf3ea6415Evan Hunt <varlistentry>
32d24fef856a5938278abe502f02a66f4f608a05Mark Andrews <term>-s <replaceable class="parameter">server</replaceable></term>
8462dfb880040cde3a60f047ec18808737fd7e85Mark Andrews <para><replaceable class="parameter">server</replaceable> is
53402b52b67aa6cbbd1d437d6cf8984e7175319eEvan Hunt the name or address of the server which matches a
53402b52b67aa6cbbd1d437d6cf8984e7175319eEvan Hunt server statement in the configuration file for
53402b52b67aa6cbbd1d437d6cf8984e7175319eEvan Hunt <command>rndc</command>. If no server is supplied on the
03958ad4b9fd6b2d6f1fbf20e85d8ff2a1f9d069Mark Andrews command line, the host named by the default-server clause
03958ad4b9fd6b2d6f1fbf20e85d8ff2a1f9d069Mark Andrews in the options statement of the <command>rndc</command>
03958ad4b9fd6b2d6f1fbf20e85d8ff2a1f9d069Mark Andrews configuration file will be used.
fcc04c160feef526cc209ca03e8bbdfe34afd83bMark Andrews </varlistentry>
fcc04c160feef526cc209ca03e8bbdfe34afd83bMark Andrews <varlistentry>
f0058a25b0de3246c63e4ca95788c611b3896a97Mark Andrews <term>-p <replaceable class="parameter">port</replaceable></term>
e85702ce5be33d7c07eff6487c6bb4730165f331Mark Andrews Send commands to TCP port
03ccae042b4acd22805d667f823066d3690965cfMark Andrews <replaceable class="parameter">port</replaceable>
6f7abb89ec22aef5eda40ed60fcf605a42b78d4dMark Andrews of BIND 9's default control channel port, 953.
b123b265e3a3d9b72a14230b6517e0f6fdb5c5b5Mark Andrews </varlistentry>
b123b265e3a3d9b72a14230b6517e0f6fdb5c5b5Mark Andrews <varlistentry>
abff0f462a758383d012887d3a97da4dac0c5a94Evan Hunt Quiet mode: Message text returned by the server
abff0f462a758383d012887d3a97da4dac0c5a94Evan Hunt will not be printed except when there is an error.
177be355d4ccf0ce6308e3e6c0f5404eaf13e9a0Evan Hunt </varlistentry>
2b8bed6681d1541474f022586cbe728dfce36880Evan Hunt <varlistentry>
2b8bed6681d1541474f022586cbe728dfce36880Evan Hunt Instructs <command>rndc</command> to print the result code
2b8bed6681d1541474f022586cbe728dfce36880Evan Hunt returned by <command>named</command> after executing the
2b8bed6681d1541474f022586cbe728dfce36880Evan Hunt requested command (e.g., ISC_R_SUCCESS, ISC_R_FAILURE, etc).
de5890da9b87cb4b91aca033db0e25b1fdb68c77Evan Hunt </varlistentry>
de5890da9b87cb4b91aca033db0e25b1fdb68c77Evan Hunt <varlistentry>
538f4a22b1cbde59a9e53fef51583904a7f7393fMark Andrews Enable verbose logging.
706219e547c90fb7d9435b20e70fb4003dc6dfd5Evan Hunt </varlistentry>
03ccae042b4acd22805d667f823066d3690965cfMark Andrews <varlistentry>
2f21adbc6a0962117015a51a44b33a99f3f94ac7Evan Hunt <term>-y <replaceable class="parameter">key_id</replaceable></term>
4d077be1351ea10db3bc7843865a5d1ba1e81d5bEvan Hunt Use the key <replaceable class="parameter">key_id</replaceable>
4d077be1351ea10db3bc7843865a5d1ba1e81d5bEvan Hunt from the configuration file.
2e22f903da490cefb98e0c8b14ac66b466cfe1d9Mark Andrews <replaceable class="parameter">key_id</replaceable>
2e22f903da490cefb98e0c8b14ac66b466cfe1d9Mark Andrews known by <command>named</command> with the same algorithm and secret string
b13b4520207e401d81d7e759162ede870896d82dMark Andrews in order for control message validation to succeed.
b13b4520207e401d81d7e759162ede870896d82dMark Andrews If no <replaceable class="parameter">key_id</replaceable>
b13b4520207e401d81d7e759162ede870896d82dMark Andrews is specified, <command>rndc</command> will first look
8c9d5521e760ead39f75adc3c87dc1dd0f9c101dMark Andrews for a key clause in the server statement of the server
8c9d5521e760ead39f75adc3c87dc1dd0f9c101dMark Andrews being used, or if no server statement is present for that
8c9d5521e760ead39f75adc3c87dc1dd0f9c101dMark Andrews host, then the default-key clause of the options statement.
8c9d5521e760ead39f75adc3c87dc1dd0f9c101dMark Andrews Note that the configuration file contains shared secrets
03ccae042b4acd22805d667f823066d3690965cfMark Andrews which are used to send authenticated control commands
2786b6c53fb198d742e9738294fa0a51a52e4dceckb to name servers. It should therefore not have general read
2786b6c53fb198d742e9738294fa0a51a52e4dceckb or write access.
20b95f5ff63cdae6bb5d4b96c1cc6e6e5373df8eMark Andrews </varlistentry>
c3b9fad5e3be639c9b36ff0ac921c30133da395cMar Andrews </variablelist>
39bfdc2ff9da3c2ecdbc70d46cabfd56d66f24f6Mark Andrews </refsection>
03ccae042b4acd22805d667f823066d3690965cfMark Andrews <refsection><info><title>COMMANDS</title></info>
03ccae042b4acd22805d667f823066d3690965cfMark Andrews A list of commands supported by <command>rndc</command> can
03ccae042b4acd22805d667f823066d3690965cfMark Andrews be seen by running <command>rndc</command> without arguments.
aecadaf3b1bbbe0bd58f703989baf38eedd0ffcackb Currently supported commands are:
55670a1e5517e9587171e9f41dc8f3e40b6fcfefMark Andrews <variablelist>
55670a1e5517e9587171e9f41dc8f3e40b6fcfefMark Andrews <varlistentry>
22394e1e4b925712c7a8f65c6779db9e032f5393Mark Andrews <term><userinput>addzone <replaceable>zone</replaceable> <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional> <replaceable>configuration</replaceable> </userinput></term>
8f4572372c4b496a43b50a6c14d82f2aba26a054Mark Andrews Add a zone while the server is running. This
8f4572372c4b496a43b50a6c14d82f2aba26a054Mark Andrews command requires the
4786e693a7c4b41ba4554f06a2f6d16c74017f15Mark Andrews <command>allow-new-zones</command> option to be set
4786e693a7c4b41ba4554f06a2f6d16c74017f15Mark Andrews <replaceable>configuration</replaceable> string
4d30dd89f5dba10b3ffc0531c35ec635033d310bMark Andrews specified on the command line is the zone
4d30dd89f5dba10b3ffc0531c35ec635033d310bMark Andrews configuration text that would ordinarily be
c2e80cf47ebb1ceecb4ad2ee01191ba2677f6feeMark Andrews The configuration is saved in a file called
f83542787f882444d2abf9fcaf47a34c29e4fec2Mark Andrews <filename><replaceable>name</replaceable>.nzf</filename>,
e7dfefe19d70b4c86f9a999bebc27ebf9a8590a2Evan Hunt name of the view, or if it contains characters
e7dfefe19d70b4c86f9a999bebc27ebf9a8590a2Evan Hunt that are incompatible with use as a file name, a
e7dfefe19d70b4c86f9a999bebc27ebf9a8590a2Evan Hunt cryptographic hash generated from the name
e7dfefe19d70b4c86f9a999bebc27ebf9a8590a2Evan Hunt of the view.
f46168b87966f679a22aaf494c555f0de821aff9Evan Hunt restarted, the file will be loaded into the view
f46168b87966f679a22aaf494c555f0de821aff9Evan Hunt configuration, so that zones that were added
f46168b87966f679a22aaf494c555f0de821aff9Evan Hunt can persist after a restart.
57c3a831c5314c16c40e519b3b70071b2001c3efMark Andrews would add the zone <literal>example.com</literal>
2f57f353e8d0b761884303f49e0c2a937b7d6243Evan Hunt to the default view:
2f57f353e8d0b761884303f49e0c2a937b7d6243Evan Hunt<prompt>$ </prompt><userinput>rndc addzone example.com '{ type master; file "example.com.db"; };'</userinput>
4b3d727d96fc3ee3a0c12c716f14163adfcf1fedEvan Hunt (Note the brackets and semi-colon around the zone
b3f23e7a7d5aeddf1fc2d3b658b2a72c5710327fMark Andrews configuration text.)
d65a29175a23d43511ae7554e347d4519c9594fcEvan Hunt See also <command>rndc delzone</command> and <command>rndc modzone</command>.
b3f23e7a7d5aeddf1fc2d3b658b2a72c5710327fMark Andrews </varlistentry>
47c5b8af920a93763c97d9a93ea1fd766961a5b3Evan Hunt <varlistentry>
47c5b8af920a93763c97d9a93ea1fd766961a5b3Evan Hunt <term><userinput>delzone <optional>-clean</optional> <replaceable>zone</replaceable> <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional> </userinput></term>
3b9b4c75f9121de7824b1e621921bb407e82d3c6Evan Hunt Delete a zone while the server is running.
965371b8cffbd02d667594c8e17e413c723f9112Mark Andrews If the <option>-clean</option> argument is specified,
965371b8cffbd02d667594c8e17e413c723f9112Mark Andrews the zone's master file (and journal file, if any)
de0fd6809754ad9dc47b7c60fda8f4c8b22ea1f8Mark Andrews will be deleted along with the zone. Without the
de0fd6809754ad9dc47b7c60fda8f4c8b22ea1f8Mark Andrews <option>-clean</option> option, zone files must
de0fd6809754ad9dc47b7c60fda8f4c8b22ea1f8Mark Andrews be cleaned up by hand. (If the zone is of
de0fd6809754ad9dc47b7c60fda8f4c8b22ea1f8Mark Andrews type "slave" or "stub", the files needing to
f3f76f009b282953652770408be38e6f9e47cbb3ckb be cleaned up will be reported in the output
b3f23e7a7d5aeddf1fc2d3b658b2a72c5710327fMark Andrews of the <command>rndc delzone</command> command.)
0fbd29837a5911e0f0a83fca93aa4453200a8ccfMark Andrews If the zone was originally added via
1c8f2b6dcd0b3952e4f5f2d6a2f0225675379739Mark Andrews <command>rndc addzone</command>, then it will be
1c8f2b6dcd0b3952e4f5f2d6a2f0225675379739Mark Andrews removed permanently. However, if it was originally
1c8f2b6dcd0b3952e4f5f2d6a2f0225675379739Mark Andrews configured in <filename>named.conf</filename>, then
1c8f2b6dcd0b3952e4f5f2d6a2f0225675379739Mark Andrews that original configuration is still in place; when
b3f23e7a7d5aeddf1fc2d3b658b2a72c5710327fMark Andrews the server is restarted or reconfigured, the zone will
47c6d89485d2ec62e94eda745267e7387f995e96Mark Andrews come back. To remove it permanently, it must also be
7786d6542bb800be7d8c56793985d510626806b2Mark Andrews See also <command>rndc addzone</command> and <command>rndc modzone</command>.
91dd13bacf452437b6f0284bacd4c7f6f763cb45Mark Andrews </varlistentry>
dbf693fdfd2bb495cf6d176ecebd173331c3d94aMark Andrews <varlistentry>
611dc8876869036ab5e981e53ae7a446145d9354Mark Andrews <term><userinput>dnstap-reopen</userinput></term>
2ec7373254331f183ae62a13acbac24c80a6a3aaMark Andrews Close and re-open DNSTAP output files. This allows the files
3806133da574f4570db3005473e0d56b746cc6eaEvan Hunt to be renamed externally then to be re-opened.
3806133da574f4570db3005473e0d56b746cc6eaEvan Hunt </varlistentry>
3806133da574f4570db3005473e0d56b746cc6eaEvan Hunt <varlistentry>
41bbb34bc20f189af62e7047ce42822615417f15Evan Hunt <term><userinput>dumpdb <optional>-all|-cache|-zone|-adb|-bad|-fail</optional> <optional><replaceable>view ...</replaceable></optional></userinput></term>
058e44186b74531402c1f99088eb9dbe4926f8daMark Andrews Dump the server's caches (default) and/or zones to
9e70b51d3b19b0592116e722a7452383a0e8e366Mark Andrews dump file for the specified views. If no view is
9e70b51d3b19b0592116e722a7452383a0e8e366Mark Andrews specified, all
aa49af836ce7a7a2888f5cedf4cbb14ff4dc1d11Mark Andrews views are dumped.
aa49af836ce7a7a2888f5cedf4cbb14ff4dc1d11Mark Andrews (See the <command>dump-file</command> option in
aa49af836ce7a7a2888f5cedf4cbb14ff4dc1d11Mark Andrews the BIND 9 Administrator Reference Manual.)
c22f896f3ae1d7258e99a090ded1f7fe3e232322Evan Hunt </varlistentry>
b3f23e7a7d5aeddf1fc2d3b658b2a72c5710327fMark Andrews <varlistentry>
da35568c7169d7218b0be7203ed03e2e626566c0Evan Hunt Flushes the server's cache.
3192f9981331ae89c91a03f1c0f1e3b843fd4f21Evan Hunt </varlistentry>
fec1c619189b1fec1f63528363bf600cd0b1a87eMark Andrews <varlistentry>
fec1c619189b1fec1f63528363bf600cd0b1a87eMark Andrews <term><userinput>flushname</userinput> <replaceable>name</replaceable> <optional><replaceable>view</replaceable></optional> </term>
27809a2ee5db141b684e53bf1d94da26e9f92d3aMark Andrews Flushes the given name from the view's DNS cache
27809a2ee5db141b684e53bf1d94da26e9f92d3aMark Andrews and, if applicable, from the view's nameserver address
05284949f73d496092c6f21f1ef9d788075fa2dbEvan Hunt database, bad server cache and SERVFAIL cache.
664320a88f4782d0bccf012da01a39dd54632d24Evan Hunt </varlistentry>
664320a88f4782d0bccf012da01a39dd54632d24Evan Hunt <varlistentry>
eed495737be4846ab054654a48f3387f77cadaaaMark Andrews <term><userinput>flushtree</userinput> <replaceable>name</replaceable> <optional><replaceable>view</replaceable></optional> </term>
5f26ffc2b4afc462acef8766ce5418cb4d75bfffMark Andrews Flushes the given name, and all of its subdomains,
5f26ffc2b4afc462acef8766ce5418cb4d75bfffMark Andrews from the view's DNS cache, address database,
b3f23e7a7d5aeddf1fc2d3b658b2a72c5710327fMark Andrews bad server cache, and SERVFAIL cache.
179d8f4cc893420557c38d940b611404608d0239ckb </listitem>
b3f23e7a7d5aeddf1fc2d3b658b2a72c5710327fMark Andrews </varlistentry>
4c2168728cbfc210e35cd438fe57b95fb55d738aMark Andrews <varlistentry>
4c2168728cbfc210e35cd438fe57b95fb55d738aMark Andrews <term><userinput>freeze <optional><replaceable>zone</replaceable> <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></optional></userinput></term>
4118cd4276c3f53f9f6f0133688e05e52d70336bMark Andrews Suspend updates to a dynamic zone. If no zone is
4118cd4276c3f53f9f6f0133688e05e52d70336bMark Andrews specified, then all zones are suspended. This allows
4118cd4276c3f53f9f6f0133688e05e52d70336bMark Andrews manual edits to be made to a zone normally updated by
8e0a15f42f06d1616b6f5d43658e2f90ff91cbfaMark Andrews dynamic update. It also causes changes in the
8e0a15f42f06d1616b6f5d43658e2f90ff91cbfaMark Andrews journal file to be synced into the master file.
8e0a15f42f06d1616b6f5d43658e2f90ff91cbfaMark Andrews All dynamic update attempts will be refused while
d1f43359e4349bb9d934b96b7aa22b54ae7cef7cMark Andrews the zone is frozen.
b29e8482207fe64ea15960f2048a60e6a37e00ebMark Andrews </varlistentry>
34fba65d39b884775c30da2ae4eee15973b1b30dMark Andrews <varlistentry>
339f08ee1eea16401bb9fbd9232a336cf6f52a8dckb <term><userinput>halt <optional>-p</optional></userinput></term>
339f08ee1eea16401bb9fbd9232a336cf6f52a8dckb <listitem>
78ba74e63db0c30b30107106dfd4f7e6f671dc35Evan Hunt Stop the server immediately. Recent changes
78ba74e63db0c30b30107106dfd4f7e6f671dc35Evan Hunt made through dynamic update or IXFR are not saved to
1bbd36c4db2c86762b582db4b0504e6e68a183f6Mark Andrews the master files, but will be rolled forward from the
1bbd36c4db2c86762b582db4b0504e6e68a183f6Mark Andrews journal files when the server is restarted.
1bbd36c4db2c86762b582db4b0504e6e68a183f6Mark Andrews If <option>-p</option> is specified <command>named</command>'s process id is returned.
85705b4b5a4b666981997ffe222738d281b9bf58Evan Hunt This allows an external process to determine when <command>named</command>
85705b4b5a4b666981997ffe222738d281b9bf58Evan Hunt had completed halting.
820fdd61dd35e359a8e616031209d074a7140d97Evan Hunt </varlistentry>
8f6d6d72e80314bd36c50f1805e424b6f6332caeEvan Hunt <varlistentry>
b8493d3292459454aeaf4d1ef10750f2e4e52d8eMark Andrews <term><userinput>loadkeys <replaceable>zone</replaceable> <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></userinput></term>
3f755529ee7ecdc9227eed572e007cf71d4d5107Evan Hunt Fetch all DNSSEC keys for the given zone
b8493d3292459454aeaf4d1ef10750f2e4e52d8eMark Andrews from the key directory. If they are within
3f755529ee7ecdc9227eed572e007cf71d4d5107Evan Hunt their publication period, merge them into the
5f250186409cff46d0409c6d3cc34d4bf08f1d17Mark Andrews zone's DNSKEY RRset. Unlike <command>rndc
5f250186409cff46d0409c6d3cc34d4bf08f1d17Mark Andrews sign</command>, however, the zone is not
1eb871bb42d2728377ea1ebcb3c1ebb2d9535f3cMar Andrews immediately re-signed by the new keys, but is
1eb871bb42d2728377ea1ebcb3c1ebb2d9535f3cMar Andrews allowed to incrementally re-sign over time.
e7857b5ee05414961bb11f9e57f654163fae6acbckb This command requires that the
3ce2018dfa0912a29666e7e477a9daddf23fc224Mark Andrews and also requires the zone to be configured to
6eb6af6732194157224e2b8d81a02a9e80c4530aMark Andrews allow dynamic DNS.
6eb6af6732194157224e2b8d81a02a9e80c4530aMark Andrews (See "Dynamic Update Policies" in the Administrator
c965b1869024ab38518fade703cc1dae2d71a59eMark Andrews Reference Manual for more details.)
ee2f98d5cf12c86e7590efcdf6725ab133a430f3Mark Andrews </varlistentry>
ee2f98d5cf12c86e7590efcdf6725ab133a430f3Mark Andrews <varlistentry>
c963ca7542743c4b1293b245b8750bfdcdde7580Mark Andrews <term><userinput>managed-keys <replaceable>(status | refresh | sync)</replaceable> <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></userinput></term>
c963ca7542743c4b1293b245b8750bfdcdde7580Mark Andrews When run with the "status" keyword, print the current
d0d892f44941986629021fcdad388d54de829ea0Mark Andrews status of the managed-keys database for the specified
d0d892f44941986629021fcdad388d54de829ea0Mark Andrews view, or for all views if none is specified. When run
d0d892f44941986629021fcdad388d54de829ea0Mark Andrews with the "refresh" keyword, force an immediate refresh
d0d892f44941986629021fcdad388d54de829ea0Mark Andrews of all the managed-keys in the specified view, or all
1a594d204a1d63538e76f8453be1f4ce9f87b88eMark Andrews views. When run with the "sync" keyword, force an
1a594d204a1d63538e76f8453be1f4ce9f87b88eMark Andrews immediate dump of the managed-keys database to disk (in
b8493d3292459454aeaf4d1ef10750f2e4e52d8eMark Andrews the file <filename>managed-keys.bind</filename> or
b8493d3292459454aeaf4d1ef10750f2e4e52d8eMark Andrews (<filename><replaceable>viewname</replaceable>.mkeys</filename>).
34fba65d39b884775c30da2ae4eee15973b1b30dMark Andrews </varlistentry>
b8493d3292459454aeaf4d1ef10750f2e4e52d8eMark Andrews <varlistentry>
b8493d3292459454aeaf4d1ef10750f2e4e52d8eMark Andrews <term><userinput>modzone <replaceable>zone</replaceable> <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional> <replaceable>configuration</replaceable> </userinput></term>
cdd271b14aebc6a3f076eb82a016e0a4d0d4247aEvan Hunt Modify the configuration of a zone while the server
cdd271b14aebc6a3f076eb82a016e0a4d0d4247aEvan Hunt is running. This command requires the
d64138e5778e99a994039b3861471929a49a2042Evan Hunt specified on the command line is the zone
2bf80ddc755eec26a75beff63e4f83f88a4c5ba9Mark Andrews configuration text that would ordinarily be
2bf80ddc755eec26a75beff63e4f83f88a4c5ba9Mark Andrews If the zone was originally added via
2bf80ddc755eec26a75beff63e4f83f88a4c5ba9Mark Andrews <command>rndc addzone</command>, the configuration
2bf80ddc755eec26a75beff63e4f83f88a4c5ba9Mark Andrews changes will be recorded permanently and will still be
2bf80ddc755eec26a75beff63e4f83f88a4c5ba9Mark Andrews in effect after the server is restarted or reconfigured.
2bf80ddc755eec26a75beff63e4f83f88a4c5ba9Mark Andrews However, if it was originally configured in
00c605a6438c16d4159aa7951e31ec5ed00812eeMark Andrews <filename>named.conf</filename>, then that original
00c605a6438c16d4159aa7951e31ec5ed00812eeMark Andrews configuration is still in place; when the server is
c41c261fc7b2ae573fab3675a03a5f1ef099a2eaMark Andrews restarted or reconfigured, the zone will revert to
c41c261fc7b2ae573fab3675a03a5f1ef099a2eaMark Andrews its original configuration. To make the changes
c41c261fc7b2ae573fab3675a03a5f1ef099a2eaMark Andrews permanent, it must also be modified in
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews See also <command>rndc addzone</command> and <command>rndc delzone</command>.
b8493d3292459454aeaf4d1ef10750f2e4e52d8eMark Andrews </varlistentry>
b8493d3292459454aeaf4d1ef10750f2e4e52d8eMark Andrews <varlistentry>
b8493d3292459454aeaf4d1ef10750f2e4e52d8eMark Andrews <term><userinput>notify <replaceable>zone</replaceable> <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></userinput></term>
3d1eaf18c7603dfc134000488447dcb40d9d2bc5ckb Resend NOTIFY messages for the zone.
7865ea9545f28f12f046b32d24c989e8441b9812Mark Andrews </varlistentry>
57f1d800f8866d8b45cc130d31a92742a7c37e23Mark Andrews <varlistentry>
c298583db573a329f37d43301d8c3c812500ac85Mark Andrews Sets the server's debugging level to 0.
04e5f9812cb02d5d86b542dfa9a394f074ff5621Evan Hunt </varlistentry>
03ccae042b4acd22805d667f823066d3690965cfMark Andrews <varlistentry>
7310c0b1ee680a4bcb0bcaa55798e64b97c9da18Mark Andrews <optional>( -d | -f | -r | -l <replaceable>duration</replaceable>)</optional>
7310c0b1ee680a4bcb0bcaa55798e64b97c9da18Mark Andrews <optional><replaceable>view</replaceable></optional>
432defb06aff07e35c762cbb9952eeb4d1957224Mark Andrews Sets a DNSSEC negative trust anchor (NTA)
e928207c3866f562d2800abb2afde59738c9294eMark Andrews for <option>domain</option>, with a lifetime of
b8493d3292459454aeaf4d1ef10750f2e4e52d8eMark Andrews <option>duration</option>. The default lifetime is
57a2236357a3f9c5f13a85e247f4cec7b724bcd0Vernon Schryver configured in <filename>named.conf</filename> via the
b8493d3292459454aeaf4d1ef10750f2e4e52d8eMark Andrews <option>nta-lifetime</option> option, and defaults to
57a2236357a3f9c5f13a85e247f4cec7b724bcd0Vernon Schryver one hour. The lifetime cannot exceed one week.
57a2236357a3f9c5f13a85e247f4cec7b724bcd0Vernon Schryver A negative trust anchor selectively disables
57a2236357a3f9c5f13a85e247f4cec7b724bcd0Vernon Schryver DNSSEC validation for zones that are known to be
57a2236357a3f9c5f13a85e247f4cec7b724bcd0Vernon Schryver failing because of misconfiguration rather than
57a2236357a3f9c5f13a85e247f4cec7b724bcd0Vernon Schryver an attack. When data to be validated is
57a2236357a3f9c5f13a85e247f4cec7b724bcd0Vernon Schryver at or below an active NTA (and above any other
57a2236357a3f9c5f13a85e247f4cec7b724bcd0Vernon Schryver configured trust anchors), <command>named</command> will
57a2236357a3f9c5f13a85e247f4cec7b724bcd0Vernon Schryver abort the DNSSEC validation process and treat the data as
57a2236357a3f9c5f13a85e247f4cec7b724bcd0Vernon Schryver insecure rather than bogus. This continues until the
57a2236357a3f9c5f13a85e247f4cec7b724bcd0Vernon Schryver NTA's lifetime is elapsed.
26833735d3d95e731a1cfb2a9b12c9bc10ba208aEvan Hunt NTAs persist across restarts of the <command>named</command> server.
26833735d3d95e731a1cfb2a9b12c9bc10ba208aEvan Hunt The NTAs for a view are saved in a file called
26833735d3d95e731a1cfb2a9b12c9bc10ba208aEvan Hunt <filename><replaceable>name</replaceable>.nta</filename>,
26833735d3d95e731a1cfb2a9b12c9bc10ba208aEvan Hunt name of the view, or if it contains characters
b8493d3292459454aeaf4d1ef10750f2e4e52d8eMark Andrews that are incompatible with use as a file name, a
b8493d3292459454aeaf4d1ef10750f2e4e52d8eMark Andrews cryptographic hash generated from the name
01695063c6c4543c39d8a2a98a2108ce7e7aa416Evan Hunt of the view.
d878b8d87c3f46a25ccae9f5cfe6e39af67562e0Evan Hunt An existing NTA can be removed by using the
dd2a0a6d2dec1c23787351e51b434a838dec5603Evan Hunt An NTA's lifetime can be specified with the
dd2a0a6d2dec1c23787351e51b434a838dec5603Evan Hunt suffixes can be used to specify the lifetime in
dd2a0a6d2dec1c23787351e51b434a838dec5603Evan Hunt seconds, minutes, or hours. If the specified NTA
dd2a0a6d2dec1c23787351e51b434a838dec5603Evan Hunt already exists, its lifetime will be updated to the
dd2a0a6d2dec1c23787351e51b434a838dec5603Evan Hunt new value. Setting <option>lifetime</option> to zero
dd2a0a6d2dec1c23787351e51b434a838dec5603Evan Hunt If <option>-dump</option> is used, any other arguments
dd2a0a6d2dec1c23787351e51b434a838dec5603Evan Hunt are ignored, and a list of existing NTAs is printed
dd2a0a6d2dec1c23787351e51b434a838dec5603Evan Hunt (note that this may include NTAs that are expired but
dd2a0a6d2dec1c23787351e51b434a838dec5603Evan Hunt have not yet been cleaned up).
dd2a0a6d2dec1c23787351e51b434a838dec5603Evan Hunt Normally, <command>named</command> will periodically
dd2a0a6d2dec1c23787351e51b434a838dec5603Evan Hunt test to see whether data below an NTA can now be
dd2a0a6d2dec1c23787351e51b434a838dec5603Evan Hunt validated (see the <option>nta-recheck</option> option
dd2a0a6d2dec1c23787351e51b434a838dec5603Evan Hunt in the Administrator Reference Manual for details).
dd2a0a6d2dec1c23787351e51b434a838dec5603Evan Hunt If data can be validated, then the NTA is regarded as
dd2a0a6d2dec1c23787351e51b434a838dec5603Evan Hunt no longer necessary, and will be allowed to expire
dd2a0a6d2dec1c23787351e51b434a838dec5603Evan Hunt behavior and forces an NTA to persist for its entire
dd2a0a6d2dec1c23787351e51b434a838dec5603Evan Hunt lifetime, regardless of whether data could be
dd2a0a6d2dec1c23787351e51b434a838dec5603Evan Hunt validated if the NTA were not present.
c438f1beb920b01adde08b32bfcfa085d7ce3efeMark Andrews All of these options can be shortened, i.e., to
c438f1beb920b01adde08b32bfcfa085d7ce3efeMark Andrews <option>-l</option>, <option>-r</option>, <option>-d</option>,
54489ba1672458382e8dfb5490fcfc7230f8ea85Evan Hunt </varlistentry>
4e8fe357a619ae2b789b15df7e3d6abf782b4a71Evan Hunt <varlistentry>
4e8fe357a619ae2b789b15df7e3d6abf782b4a71Evan Hunt <term><userinput>querylog</userinput> <optional>on|off</optional> </term>
4e8fe357a619ae2b789b15df7e3d6abf782b4a71Evan Hunt Enable or disable query logging. (For backward
1a04af5311b46955fd8c0207cc7bad1b1d632f7fMark Andrews compatibility, this command can also be used without
1a04af5311b46955fd8c0207cc7bad1b1d632f7fMark Andrews an argument to toggle query logging on and off.)
393fd55d91306e6def3a3d06748eee031f57bd17Mark Andrews Query logging can also be enabled
7e9d6c707501c75c4caa1922af5c7d97b4895064Mark Andrews by explicitly directing the <command>queries</command>
4c9c2a6a72616ac8a614204dc0721afcb2095f67Mark Andrews <filename>named.conf</filename> or by specifying
20d441892d670cab7a58bbd36f4e92ae73b10a20Evan Hunt </varlistentry>
e71acb8fbb0201a1b240dfd2e87a2524655884deMark Andrews <varlistentry>
75582adac73202213d936dc0850f1c9cf47d6cbeMark Andrews Reload the configuration file and load new zones,
75582adac73202213d936dc0850f1c9cf47d6cbeMark Andrews but do not reload existing zone files even if they
75582adac73202213d936dc0850f1c9cf47d6cbeMark Andrews have changed.
75582adac73202213d936dc0850f1c9cf47d6cbeMark Andrews This is faster than a full <command>reload</command> when there
20d441892d670cab7a58bbd36f4e92ae73b10a20Evan Hunt is a large number of zones because it avoids the need
20d441892d670cab7a58bbd36f4e92ae73b10a20Evan Hunt to examine the
b4b1e8f18bdf504ca3b6b5911d79c6d1570d59e7Mark Andrews modification times of the zones files.
840659f1d7e09b9cd4af283aeadfbfe173b57a06Mark Andrews </varlistentry>
840659f1d7e09b9cd4af283aeadfbfe173b57a06Mark Andrews <varlistentry>
66f51d8678c8fcc7256354b599317f67455120fdMark Andrews Dump the list of queries <command>named</command> is currently
56fdf1d4014b0901e723d22c0bf7503c086af2d5Mark Andrews recursing on, and the list of domains to which iterative
56fdf1d4014b0901e723d22c0bf7503c086af2d5Mark Andrews queries are currently being sent. (The second list includes
56fdf1d4014b0901e723d22c0bf7503c086af2d5Mark Andrews the number of fetches currently active for the given domain,
85fcd0b9b2d80be4646187d7094e5644a52e3263Mark Andrews and how many have been passed or dropped because of the
2c642143d45517bfc0990d9194a7cc536f3fce89Mark Andrews </varlistentry>
2c642143d45517bfc0990d9194a7cc536f3fce89Mark Andrews <varlistentry>
c51f2c9a529b2130a8058cb7a32bd284fa6cfdb9Mark Andrews <term><userinput>refresh <replaceable>zone</replaceable> <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></userinput></term>
d8e73b1c76f2c7dcc641bfa7759c15df58c82c7eMark Andrews Schedule zone maintenance for the given zone.
269c07173e24d7811e2fd09304023e3104fcbe0bMark Andrews </varlistentry>
962bf88eec1ea34a451769ba82c9389db7f0bef0Mark Andrews <varlistentry>
4bb9db2aed9860f7ca63f925a4b9d48e07917988Mark Andrews Reload configuration file and zones.
c6581f1ae41f8cfdaf983a0cc4936365040060a2Mark Andrews </varlistentry>
e5bf06eedc08179fb93a09799915139370d08055Evan Hunt <varlistentry>
e5bf06eedc08179fb93a09799915139370d08055Evan Hunt <term><userinput>reload <replaceable>zone</replaceable> <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></userinput></term>
1864400107f7dc21e1797d602ab1f8523f599df9Mark Andrews Reload the given zone.
261543671b70b078a2d55bbf16ef78ae2074bbdcEvan Hunt </varlistentry>
490b05960c9956cc37f52f5fd4443829d75ce7d6Mark Andrews <varlistentry>
490b05960c9956cc37f52f5fd4443829d75ce7d6Mark Andrews <term><userinput>retransfer <replaceable>zone</replaceable> <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></userinput></term>
89069e6b3abc5ab00c77227f31b771cc2fa4768fEvan Hunt Retransfer the given slave zone from the master server.
6d386978b3a1f20a613ae10565c855aee084e2a0Mark Andrews If the zone is configured to use
5b57f580ce54201c6105300ea6636677531163f9Mark Andrews version of the zone is discarded; after the
5b57f580ce54201c6105300ea6636677531163f9Mark Andrews retransfer of the unsigned version is complete, the
5b57f580ce54201c6105300ea6636677531163f9Mark Andrews signed version will be regenerated with all new
fb604d1cee223986d090763292015309adfcf9c7Mark Andrews </varlistentry>
c478bb4c4658dddabe79118e2f84107640aa06c4Mark Andrews <varlistentry>
936036e82337c5aba40e735e5b46f9112869772fMark Andrews Scan the list of available network interfaces
936036e82337c5aba40e735e5b46f9112869772fMark Andrews for changes, without performing a full
fc3b3e1f7e4ec1cf3bcc08f7ecc3ed8ebd29b034Mark Andrews </varlistentry>
fc3b3e1f7e4ec1cf3bcc08f7ecc3ed8ebd29b034Mark Andrews <varlistentry>
3fd0334e59fe72294bedafc9cb0f74d66b1cfe3aMark Andrews <term><userinput>secroots <optional>-</optional> <optional><replaceable>view ...</replaceable></optional></userinput></term>
99f6179191e583d23f3c5567d3c00b57b64eb52dEvan Hunt Dump the server's security roots and negative trust anchors
3fd0334e59fe72294bedafc9cb0f74d66b1cfe3aMark Andrews for the specified views. If no view is specified, all views
77cb7130e721c1352009c86fb2b38eedd06c4f97Mark Andrews If the first argument is "-", then the output is
adfc3ad3ce5db585fdb29d3d6000aa05ba077f13Evan Hunt returned via the <command>rndc</command> response channel
fc3b3e1f7e4ec1cf3bcc08f7ecc3ed8ebd29b034Mark Andrews and printed to the standard output.
adfc3ad3ce5db585fdb29d3d6000aa05ba077f13Evan Hunt Otherwise, it is written to the secroots dump file, which
adfc3ad3ce5db585fdb29d3d6000aa05ba077f13Evan Hunt defaults to <filename>named.secroots</filename>, but can be
73d187eab95980e7af7b31a22e522ed5ea1561d7Mark Andrews overridden via the <option>secroots-file</option> option in
93143fd81acd86e594bac20c6c58b930dfe63a80Evan Hunt </varlistentry>
c2e614115b19a4c28e0067e57a48f4ed5d5e12f8Mark Andrews <varlistentry>
c2e614115b19a4c28e0067e57a48f4ed5d5e12f8Mark Andrews <term><userinput>showzone <replaceable>zone</replaceable> <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional> </userinput></term>
75503c024b1a2cde5d545bc8e91b0f4e13c3398eEvan Hunt Print the configuration of a running zone.
38b260f32d2be0e916e50e8bf77957ba2627a95aMark Andrews </varlistentry>
bc298cd0f77dce2d452efd3e3d3153e2a9a17dbfMark Andrews <varlistentry>
bc298cd0f77dce2d452efd3e3d3153e2a9a17dbfMark Andrews <term><userinput>sign <replaceable>zone</replaceable> <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></userinput></term>
1bb3831e13a65afd87078c88e0285d23b1e0bcdfMark Andrews Fetch all DNSSEC keys for the given zone
1bb3831e13a65afd87078c88e0285d23b1e0bcdfMark Andrews from the key directory (see the
ef9f4d097794609e018963087fab10a8b51d8ad1Mark Andrews the BIND 9 Administrator Reference Manual). If they are within
ef9f4d097794609e018963087fab10a8b51d8ad1Mark Andrews their publication period, merge them into the
ef9f4d097794609e018963087fab10a8b51d8ad1Mark Andrews zone's DNSKEY RRset. If the DNSKEY RRset
313e570601cbe84c46b8d0427e7f1b20e71cc0c1Evan Hunt is changed, then the zone is automatically
313e570601cbe84c46b8d0427e7f1b20e71cc0c1Evan Hunt re-signed with the new key set.
9a020198893d8389f1f3172d88ba6b16d7da3c04Evan Hunt This command requires that the
9a020198893d8389f1f3172d88ba6b16d7da3c04Evan Hunt and also requires the zone to be configured to
9a020198893d8389f1f3172d88ba6b16d7da3c04Evan Hunt allow dynamic DNS.
c19cfefe7e345c37ef3bb98b0db2d14fe7b1d583Evan Hunt (See "Dynamic Update Policies" in the Administrator
c19cfefe7e345c37ef3bb98b0db2d14fe7b1d583Evan Hunt Reference Manual for more details.)
41ca314cc2fafaaa9089438bdfd24880bafa9079Mark Andrews </varlistentry>
949eefdda49701c14579d1fd251bd09df0751c2fEvan Hunt <varlistentry>
15218d6ed062ec24c4a7ec10d22d1113b4c79556Evan Hunt <term><userinput>signing <optional>( -list | -clear <replaceable>keyid/algorithm</replaceable> | -clear <literal>all</literal> | -nsec3param ( <replaceable>parameters</replaceable> | <literal>none</literal> ) | -serial <replaceable>value</replaceable> ) </optional> <replaceable>zone</replaceable> <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional> </userinput></term>
238e0e843834f24a40692a5ea28ace14ef5807ceMark Andrews List, edit, or remove the DNSSEC signing state records
238e0e843834f24a40692a5ea28ace14ef5807ceMark Andrews for the specified zone. The status of ongoing DNSSEC
238e0e843834f24a40692a5ea28ace14ef5807ceMark Andrews operations (such as signing or generating
9ddf371552b3554a22632996acc41ef9917a30f4Mark Andrews NSEC3 chains) is stored in the zone in the form
9ddf371552b3554a22632996acc41ef9917a30f4Mark Andrews of DNS resource records of type
83878aaa47488a3529897bb8ab4c2027d98b64c1Mark Andrews these records into a human-readable form,
83878aaa47488a3529897bb8ab4c2027d98b64c1Mark Andrews indicating which keys are currently signing
83878aaa47488a3529897bb8ab4c2027d98b64c1Mark Andrews or have finished signing the zone, and which NSEC3
83878aaa47488a3529897bb8ab4c2027d98b64c1Mark Andrews chains are being created or removed.
328e0fee6b6c91c258e5ce36eb70f5e017a85af2Mark Andrews <command>rndc signing -clear</command> can remove
328e0fee6b6c91c258e5ce36eb70f5e017a85af2Mark Andrews a single key (specified in the same format that
a5a30ae7c0636a57d8575acb98fdf906c0ea818fMark Andrews display it), or all keys. In either case, only
a5a30ae7c0636a57d8575acb98fdf906c0ea818fMark Andrews completed keys are removed; any record indicating
f30785f506a522ed6a5e394af2bb13b6f883927eEvan Hunt that a key has not yet finished signing the zone
f30785f506a522ed6a5e394af2bb13b6f883927eEvan Hunt will be retained.
dd0d54ff010c43eef6b96bd3ee34a9c671abc6e5Mark Andrews the NSEC3 parameters for a zone. This is the
dd0d54ff010c43eef6b96bd3ee34a9c671abc6e5Mark Andrews only supported mechanism for using NSEC3 with
dd0d54ff010c43eef6b96bd3ee34a9c671abc6e5Mark Andrews Parameters are specified in the same format as
dd0d54ff010c43eef6b96bd3ee34a9c671abc6e5Mark Andrews an NSEC3PARAM resource record: hash algorithm,
32ebb157b1d9409a186c86002827f8a1f4931f5aMark Andrews flags, iterations, and salt, in that order.
32ebb157b1d9409a186c86002827f8a1f4931f5aMark Andrews Currently, the only defined value for hash algorithm
67dc2f0536bcbbfa0970eb2893dcbc1c6713fad4Mark Andrews depending on whether you wish to set the opt-out
67dc2f0536bcbbfa0970eb2893dcbc1c6713fad4Mark Andrews bit in the NSEC3 chain. <option>iterations</option>
67dc2f0536bcbbfa0970eb2893dcbc1c6713fad4Mark Andrews defines the number of additional times to apply
67dc2f0536bcbbfa0970eb2893dcbc1c6713fad4Mark Andrews the algorithm when generating an NSEC3 hash. The
67dc2f0536bcbbfa0970eb2893dcbc1c6713fad4Mark Andrews <option>salt</option> is a string of data expressed
67dc2f0536bcbbfa0970eb2893dcbc1c6713fad4Mark Andrews in hexadecimal, a hyphen (`-') if no salt is
67dc2f0536bcbbfa0970eb2893dcbc1c6713fad4Mark Andrews to be used, or the keyword <literal>auto</literal>,
67dc2f0536bcbbfa0970eb2893dcbc1c6713fad4Mark Andrews which causes <command>named</command> to generate a
67dc2f0536bcbbfa0970eb2893dcbc1c6713fad4Mark Andrews random 64-bit salt.
b290d10fc42ae909f7319eeac68f876155dbf824Mark Andrews So, for example, to create an NSEC3 chain using
b290d10fc42ae909f7319eeac68f876155dbf824Mark Andrews the SHA-1 hash algorithm, no opt-out flag,
b290d10fc42ae909f7319eeac68f876155dbf824Mark Andrews 10 iterations, and a salt value of "FFFF", use:
1d32b1df372d6be6bac6450739b9e5ea23819995Evan Hunt <command>rndc signing -nsec3param 1 0 10 FFFF <replaceable>zone</replaceable></command>.
f5dc94b026b5153de76eeb3c1161596251f26bcbMark Andrews To set the opt-out flag, 15 iterations, and no
1d32b1df372d6be6bac6450739b9e5ea23819995Evan Hunt <command>rndc signing -nsec3param 1 1 15 - <replaceable>zone</replaceable></command>.
9ca4e2411ca45c09494716f725b8b9a25ae887d7Mark Andrews <command>rndc signing -nsec3param none</command>
108788443c2d4e4c5cc16c103bdfc7da665ed0c3Mark Andrews removes an existing NSEC3 chain and replaces it
b4d8192d210290112e07b0e22b491c45c50ba696Evan Hunt <command>rndc signing -serial value</command> sets
b4d8192d210290112e07b0e22b491c45c50ba696Evan Hunt the serial number of the zone to value. If the value
b4d8192d210290112e07b0e22b491c45c50ba696Evan Hunt would cause the serial number to go backwards it will
f5dc94b026b5153de76eeb3c1161596251f26bcbMark Andrews be rejected. The primary use is to set the serial on
b4d8192d210290112e07b0e22b491c45c50ba696Evan Hunt inline signed zones.
b4d8192d210290112e07b0e22b491c45c50ba696Evan Hunt </varlistentry>
b4d8192d210290112e07b0e22b491c45c50ba696Evan Hunt <varlistentry>
e4aac0596c89955ced3398d7e2896d05bcc70fd5Mark Andrews Write server statistics to the statistics file.
71e4c3ee745b9fbf0c627246a9896589344f613cMark Andrews (See the <command>statistics-file</command> option in
71e4c3ee745b9fbf0c627246a9896589344f613cMark Andrews the BIND 9 Administrator Reference Manual.)
04281728d41b7e04afdd0789aa3bc1a3225994f3Mark Andrews </varlistentry>
9c832595d40482529ac6d369664bb59fbc05b925Mark Andrews <varlistentry>
4122abdc3cfa16c8b3ecbd20830ca9a43f9fecb9Evan Hunt Display status of the server.
4122abdc3cfa16c8b3ecbd20830ca9a43f9fecb9Evan Hunt Note that the number of zones includes the internal <command>bind/CH</command> zone
de52784e45e3a7a92c0d8ad843eb4db313bbfd97Mark Andrews hint zone if there is not an
de52784e45e3a7a92c0d8ad843eb4db313bbfd97Mark Andrews explicit root zone configured.
b68dc65959cc38f997c365abed9f4e6c0415ecc7Mark Andrews </varlistentry>
56dc4c6730222cd3915a6ca39bc6578ad36a160aMark Andrews <varlistentry>
56dc4c6730222cd3915a6ca39bc6578ad36a160aMark Andrews <term><userinput>stop <optional>-p</optional></userinput></term>
d881a5ad06db99a42e47176028c14d09041f8807Scott Mann Stop the server, making sure any recent changes
d881a5ad06db99a42e47176028c14d09041f8807Scott Mann made through dynamic update or IXFR are first saved to
03ccae042b4acd22805d667f823066d3690965cfMark Andrews the master files of the updated zones.
553197e28833ed2d8bf26f8112eaa137dbaa040aMark Andrews If <option>-p</option> is specified <command>named</command>'s process id is returned.
553197e28833ed2d8bf26f8112eaa137dbaa040aMark Andrews This allows an external process to determine when <command>named</command>
087f83a3b928ac090fef80e5ed09712935f38e5aMark Andrews had completed stopping.
553197e28833ed2d8bf26f8112eaa137dbaa040aMark Andrews <para>See also <command>rndc halt</command>.</para>
5927944728a530e9f43597b64a555029e2d010bdScott Mann </varlistentry>
f5dc94b026b5153de76eeb3c1161596251f26bcbMark Andrews <varlistentry>
f5dc94b026b5153de76eeb3c1161596251f26bcbMark Andrews <term><userinput>sync <optional>-clean</optional> <optional><replaceable>zone</replaceable> <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></optional></userinput></term>
cae06bceda6c5d415f740574a64f42bf5f561d61Mark Andrews Sync changes in the journal file for a dynamic zone
cae06bceda6c5d415f740574a64f42bf5f561d61Mark Andrews to the master file. If the "-clean" option is
411d2914ade28174f3789d4a8e43636fc68eb310Mark Andrews specified, the journal file is also removed. If
411d2914ade28174f3789d4a8e43636fc68eb310Mark Andrews no zone is specified, then all zones are synced.
23daf8948b2e5462ccea082a441e9759dffa50cdMark Andrews </varlistentry>
9bd876a683709be588f6fac6781a76fdd57b2f08Mark Andrews <varlistentry>
03e2b1d18d6231d02a09e03d9300667fd6ef51d9Mark Andrews <term><userinput>thaw <optional><replaceable>zone</replaceable> <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></optional></userinput></term>
91ed1cc821ccef38c30f3fcaad32d78233fad94bMark Andrews Enable updates to a frozen dynamic zone. If no
91ed1cc821ccef38c30f3fcaad32d78233fad94bMark Andrews zone is specified, then all frozen zones are
91ed1cc821ccef38c30f3fcaad32d78233fad94bMark Andrews enabled. This causes the server to reload the zone
03ccae042b4acd22805d667f823066d3690965cfMark Andrews from disk, and re-enables dynamic updates after the
69feafa0af18ce7b1fd4f9d330948272e6c926a1Evan Hunt load has completed. After a zone is thawed,
69feafa0af18ce7b1fd4f9d330948272e6c926a1Evan Hunt dynamic updates will no longer be refused. If
69feafa0af18ce7b1fd4f9d330948272e6c926a1Evan Hunt the zone has changed and the
2256c131942baddeb22bb3d9d305dd52a3b3ea04Mark Andrews <command>ixfr-from-differences</command> option is
2256c131942baddeb22bb3d9d305dd52a3b3ea04Mark Andrews in use, then the journal file will be updated to
08b512b6a0c6e3c3e411275651930aeec605cf0cEvan Hunt reflect changes in the zone. Otherwise, if the
f5dc94b026b5153de76eeb3c1161596251f26bcbMark Andrews zone has changed, any existing journal file will be
2256c131942baddeb22bb3d9d305dd52a3b3ea04Mark Andrews <para>See also <command>rndc freeze</command>.</para>
7c6a1a11fa6342bd14f2804cd7753bdb1966d53dEvan Hunt </varlistentry>
7c6a1a11fa6342bd14f2804cd7753bdb1966d53dEvan Hunt <varlistentry>
6fb6f8a2263f9cbc6bf979a4d79cc7a71e86f41eEvan Hunt Increment the servers debugging level by one.
77d048b03eec3222e283426beab46ec23ecf8371Evan Hunt </varlistentry>
5d23a6ac8392b1eeec8effdee47fb725ace1e759Evan Hunt <varlistentry>
f5dc94b026b5153de76eeb3c1161596251f26bcbMark Andrews <term><userinput>trace <replaceable>level</replaceable></userinput></term>
f5dc94b026b5153de76eeb3c1161596251f26bcbMark Andrews Sets the server's debugging level to an explicit
d9eebc08497af272b2d44c07f4eb85153dec4253Evan Hunt </varlistentry>
83c0ef88159fcae73fdbf8fe04d220c1878cce3eEvan Hunt <varlistentry>
83c0ef88159fcae73fdbf8fe04d220c1878cce3eEvan Hunt <term><userinput>tsig-delete</userinput> <replaceable>keyname</replaceable> <optional><replaceable>view</replaceable></optional></term>
03ccae042b4acd22805d667f823066d3690965cfMark Andrews Delete a given TKEY-negotiated key from the server.
19ae9cbb28abf57c2605cbedaa6a7201a0cb6572Mark Andrews (This does not apply to statically configured TSIG
ca45c0bc34042b3821be46a6a95e71edd4c32c8dEvan Hunt </varlistentry>
3fb5bccf59abe5a0b545b4979181df0b17adee3bMark Andrews <varlistentry>
3fb5bccf59abe5a0b545b4979181df0b17adee3bMark Andrews List the names of all TSIG keys currently configured
90a354ab367f420147a498e026305f59bf58a72bEvan Hunt for use by <command>named</command> in each view. The
8899393ccd9fcbfcc6c027e9cb3bfd05fae29cabEvan Hunt list both statically configured keys and dynamic
90a354ab367f420147a498e026305f59bf58a72bEvan Hunt TKEY-negotiated keys.
25845da41a621f35e76dc8560ca40de6859e0a11Evan Hunt </varlistentry>
03ccae042b4acd22805d667f823066d3690965cfMark Andrews <varlistentry>
a5166d5fce30e5924f279d3e92d1f20b9fb7b4dcMark Andrews <term><userinput>validation ( on | off | check ) <optional><replaceable>view ...</replaceable></optional> </userinput></term>
f550b4b104d2859539b2ec287600f1dd2215d9fbEvan Hunt Enable, disable, or check the current status of
f550b4b104d2859539b2ec287600f1dd2215d9fbEvan Hunt DNSSEC validation.
6150d3cb666a58d5e3a15275562c9fc5c5b6b2d8Evan Hunt Note <command>dnssec-enable</command> also needs to be
fd0cb187615695ddc84ec25c88710c6c4e7cf096Evan Hunt It defaults to enabled.
d7be2b79ed0934483d550e17e2bd09de4eaff8f5Evan Hunt </varlistentry>
d7be2b79ed0934483d550e17e2bd09de4eaff8f5Evan Hunt <varlistentry>
f5dc94b026b5153de76eeb3c1161596251f26bcbMark Andrews <term><userinput>zonestatus <replaceable>zone</replaceable> <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></userinput></term>
f5dc94b026b5153de76eeb3c1161596251f26bcbMark Andrews Displays the current status of the given zone,
f5dc94b026b5153de76eeb3c1161596251f26bcbMark Andrews including the master file name and any include
7f2a245b96f3fb2fd7c644316c426b1edaa57984Evan Hunt files from which it was loaded, when it was most
77b8f02d19efea79c34f0d4afcefc7ad65de8000Evan Hunt recently loaded, the current serial number, the
77b8f02d19efea79c34f0d4afcefc7ad65de8000Evan Hunt number of nodes, whether the zone supports
77b8f02d19efea79c34f0d4afcefc7ad65de8000Evan Hunt dynamic updates, whether the zone is DNSSEC
0c25a44aac24a452a41240c45d35320ce054427dEvan Hunt signed, whether it uses automatic DNSSEC key
0c25a44aac24a452a41240c45d35320ce054427dEvan Hunt management or inline signing, and the scheduled
0c25a44aac24a452a41240c45d35320ce054427dEvan Hunt refresh or expiry times for the zone.
146057d7e755d646283adfe5d813f756b0538095Mark Andrews </varlistentry>
fe3472c80b76b6fed0ae674fd63471d02477a03aMark Andrews </variablelist>
3975f627fe9c0d3aa02ed135070e3253357daad9Mark Andrews </refsection>
3975f627fe9c0d3aa02ed135070e3253357daad9Mark Andrews <refsection><info><title>LIMITATIONS</title></info>
5caf26b168332b69c9071aac6b72ef0f50436a14Evan Hunt There is currently no way to provide the shared secret for a
5caf26b168332b69c9071aac6b72ef0f50436a14Evan Hunt <option>key_id</option> without using the configuration file.
f5dc94b026b5153de76eeb3c1161596251f26bcbMark Andrews Several error messages could be clearer.
62a348b15dd552e12bfbe94111e14072f1c8f02eMark Andrews </refsection>
7b4b6f361b2fb2291c2019b377a9c0c8e80cfd6bMark Andrews <refsection><info><title>SEE ALSO</title></info>
9c03f13e18c1b0c32f62391a17300378605bbc7bEvan Hunt <refentrytitle>rndc.conf</refentrytitle><manvolnum>5</manvolnum>
9c03f13e18c1b0c32f62391a17300378605bbc7bEvan Hunt </citerefentry>,
9c03f13e18c1b0c32f62391a17300378605bbc7bEvan Hunt <citerefentry>
f5dc94b026b5153de76eeb3c1161596251f26bcbMark Andrews <refentrytitle>rndc-confgen</refentrytitle><manvolnum>8</manvolnum>
9c03f13e18c1b0c32f62391a17300378605bbc7bEvan Hunt </citerefentry>,
9c03f13e18c1b0c32f62391a17300378605bbc7bEvan Hunt <citerefentry>
9c03f13e18c1b0c32f62391a17300378605bbc7bEvan Hunt <refentrytitle>named</refentrytitle><manvolnum>8</manvolnum>
9c03f13e18c1b0c32f62391a17300378605bbc7bEvan Hunt </citerefentry>,
c4352fb17ebb1cf29ccabdf1c4273a86f035f38bMark Andrews <citerefentry>
cd22c3e4e4ff8ad6eb399155bd8df9330aa39547Mark Andrews <refentrytitle>named.conf</refentrytitle><manvolnum>5</manvolnum>
cd22c3e4e4ff8ad6eb399155bd8df9330aa39547Mark Andrews </citerefentry>,
0148654d85b2818f9317b428a67701f4585c8243Scott Mann <citerefentry>
0148654d85b2818f9317b428a67701f4585c8243Scott Mann <refentrytitle>ndc</refentrytitle><manvolnum>8</manvolnum>
f5dc94b026b5153de76eeb3c1161596251f26bcbMark Andrews </citerefentry>,
b91b288f923d143292af3ac35df6f6cff50647f2Scott Mann <citetitle>BIND 9 Administrator Reference Manual</citetitle>.
b91b288f923d143292af3ac35df6f6cff50647f2Scott Mann </refsection>