2362N/A - Copyright (C) 2004, 2005, 2007, 2013-2015 Internet Systems Consortium, Inc. ("ISC") 0N/A - Copyright (C) 2000, 2001 Internet Software Consortium. 0N/A - Permission to use, copy, modify, and/or distribute this software for any 0N/A - purpose with or without fee is hereby granted, provided that the above 2362N/A - copyright notice and this permission notice appear in all copies. 2362N/A - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 0N/A - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 0N/A - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 0N/A - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 0N/A - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 0N/A - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 0N/A - PERFORMANCE OF THIS SOFTWARE. 0N/A<!-- Converted by db4-upgrade version 1.0 --> 0N/A <
date>2014-08-15</
date>
0N/A <
corpauthor>Internet Systems Consortium, Inc.</
corpauthor>
2548N/A <
refentrytitle><
application>rndc</
application></
refentrytitle>
0N/A <
manvolnum>8</
manvolnum>
0N/A <
refmiscinfo>BIND9</
refmiscinfo>
0N/A <
refname><
application>rndc</
application></
refname>
0N/A <
refpurpose>name server control utility</
refpurpose>
0N/A <
holder>Internet Systems Consortium, Inc. ("ISC")</
holder>
0N/A <
holder>Internet Software Consortium.</
holder>
0N/A <
cmdsynopsis sepchar=" ">
0N/A <
command>rndc</
command>
0N/A <
arg choice="opt" rep="norepeat"><
option>-b <
replaceable class="parameter">source-address</
replaceable></
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-c <
replaceable class="parameter">config-file</
replaceable></
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-k <
replaceable class="parameter">key-file</
replaceable></
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-s <
replaceable class="parameter">server</
replaceable></
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-p <
replaceable class="parameter">port</
replaceable></
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-q</
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-r</
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-V</
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-y <
replaceable class="parameter">key_id</
replaceable></
option></
arg>
0N/A <
arg choice="req" rep="norepeat">command</
arg>
0N/A <
refsection><
info><
title>DESCRIPTION</
title></
info>
0N/A <
para><
command>rndc</
command>
0N/A controls the operation of a name
0N/A server. It supersedes the <
command>ndc</
command> utility
0N/A that was provided in old BIND releases. If
0N/A <
command>rndc</
command> is invoked with no command line
0N/A options or arguments, it prints a short summary of the
0N/A supported commands and the available options and their
0N/A <
para><
command>rndc</
command>
0N/A communicates with the name server over a TCP connection, sending
0N/A commands authenticated with digital signatures. In the current
0N/A <
command>rndc</
command> and <
command>named</
command>,
0N/A the only supported authentication algorithms are HMAC-MD5
0N/A (for compatibility), HMAC-SHA1, HMAC-SHA224, HMAC-SHA256
0N/A (default), HMAC-SHA384 and HMAC-SHA512.
0N/A They use a shared secret on each end of the connection.
0N/A This provides TSIG-style authentication for the command
0N/A request and the name server's response. All commands sent
0N/A over the channel must be signed by a key_id known to the
0N/A <
para><
command>rndc</
command>
0N/A reads a configuration file to
0N/A determine how to contact the name server and decide what
0N/A algorithm and key it should use.
0N/A <
refsection><
info><
title>OPTIONS</
title></
info>
0N/A <
term>-b <
replaceable class="parameter">source-address</
replaceable></
term>
0N/A Use <
replaceable class="parameter">source-address</
replaceable>
0N/A as the source address for the connection to the server.
0N/A Multiple instances are permitted to allow setting of both
0N/A the IPv4 and IPv6 source addresses.
0N/A <
term>-c <
replaceable class="parameter">config-file</
replaceable></
term>
0N/A Use <
replaceable class="parameter">config-file</
replaceable>
0N/A as the configuration file instead of the default,
0N/A <
term>-k <
replaceable class="parameter">key-file</
replaceable></
term>
0N/A Use <
replaceable class="parameter">key-file</
replaceable>
0N/A as the key file instead of the default,
0N/A commands sent to the server if the <
replaceable class="parameter">config-file</
replaceable>
0N/A <
term>-s <
replaceable class="parameter">server</
replaceable></
term>
0N/A <
para><
replaceable class="parameter">server</
replaceable> is
0N/A the name or address of the server which matches a
0N/A server statement in the configuration file for
2081N/A <
command>rndc</
command>. If no server is supplied on the
0N/A command line, the host named by the default-server clause
0N/A in the options statement of the <
command>rndc</
command>
0N/A configuration file will be used.
0N/A <
term>-p <
replaceable class="parameter">port</
replaceable></
term>
0N/A Send commands to TCP port
0N/A <
replaceable class="parameter">port</
replaceable>
0N/A of BIND 9's default control channel port, 953.
0N/A Quiet mode: Message text returned by the server
0N/A will not be printed except when there is an error.
0N/A Instructs <
command>rndc</
command> to print the result code
0N/A returned by <
command>named</
command> after executing the
0N/A requested command (
e.g., ISC_R_SUCCESS, ISC_R_FAILURE, etc).
0N/A Enable verbose logging.
2548N/A <
term>-y <
replaceable class="parameter">key_id</
replaceable></
term>
2548N/A Use the key <
replaceable class="parameter">key_id</
replaceable>
2548N/A from the configuration file.
2548N/A <
replaceable class="parameter">key_id</
replaceable>
2548N/A known by <
command>named</
command> with the same algorithm and secret string
2548N/A in order for control message validation to succeed.
2548N/A If no <
replaceable class="parameter">key_id</
replaceable>
2548N/A is specified, <
command>rndc</
command> will first look
2548N/A for a key clause in the server statement of the server
2548N/A being used, or if no server statement is present for that
0N/A host, then the default-key clause of the options statement.
0N/A Note that the configuration file contains shared secrets
0N/A which are used to send authenticated control commands
0N/A to name servers. It should therefore not have general read
0N/A <
refsection><
info><
title>COMMANDS</
title></
info>
0N/A A list of commands supported by <
command>rndc</
command> can
0N/A be seen by running <
command>rndc</
command> without arguments.
0N/A Currently supported commands are:
0N/A <
term><
userinput>addzone <
replaceable>zone</
replaceable> <
optional><
replaceable>class</
replaceable> <
optional><
replaceable>view</
replaceable></
optional></
optional> <
replaceable>configuration</
replaceable> </
userinput></
term>
0N/A Add a zone while the server is running. This
0N/A command requires the
0N/A <
command>allow-new-zones</
command> option to be set
0N/A to <
userinput>yes</
userinput>. The
0N/A <
replaceable>configuration</
replaceable> string
0N/A specified on the command line is the zone
0N/A configuration text that would ordinarily be
0N/A The configuration is saved in a file called
0N/A <
filename><
replaceable>name</
replaceable>.nzf</
filename>,
0N/A where <
replaceable>name</
replaceable> is the
0N/A name of the view, or if it contains characters
0N/A that are incompatible with use as a file name, a
0N/A cryptographic hash generated from the name
0N/A When <
command>named</
command> is
0N/A restarted, the file will be loaded into the view
0N/A configuration, so that zones that were added
0N/A can persist after a restart.
0N/A This sample <
command>addzone</
command> command
0N/A to the default view:
0N/A (Note the brackets and semi-colon around the zone
0N/A configuration text.)
0N/A See also <
command>rndc delzone</
command> and <
command>rndc modzone</
command>.
0N/A <
term><
userinput>delzone <
optional>-clean</
optional> <
replaceable>zone</
replaceable> <
optional><
replaceable>class</
replaceable> <
optional><
replaceable>view</
replaceable></
optional></
optional> </
userinput></
term>
0N/A Delete a zone while the server is running.
0N/A If the <
option>-clean</
option> argument is specified,
0N/A the zone's master file (and journal file, if any)
0N/A will be deleted along with the zone. Without the
0N/A <
option>-clean</
option> option, zone files must
0N/A be cleaned up by hand. (If the zone is of
0N/A type "slave" or "stub", the files needing to
0N/A be cleaned up will be reported in the output
0N/A of the <
command>rndc delzone</
command> command.)
0N/A If the zone was originally added via
0N/A <
command>rndc addzone</
command>, then it will be
0N/A removed permanently. However, if it was originally
0N/A that original configuration is still in place; when
0N/A the server is restarted or reconfigured, the zone will
0N/A come back. To remove it permanently, it must also be
0N/A See also <
command>rndc addzone</
command> and <
command>rndc modzone</
command>.
0N/A <
term><
userinput>dumpdb <
optional>-all|-cache|-zone|-adb|-bad|-fail</
optional> <
optional><
replaceable>view ...</
replaceable></
optional></
userinput></
term>
0N/A Dump the server's caches (default)
and/
or zones to
0N/A dump file for the specified views. If no view is
0N/A (See the <
command>dump-file</
command> option in
0N/A the BIND 9 Administrator Reference Manual.)
0N/A <
term><
userinput>flush</
userinput></
term>
0N/A Flushes the server's cache.
0N/A <
term><
userinput>flushname</
userinput> <
replaceable>name</
replaceable> <
optional><
replaceable>view</
replaceable></
optional> </
term>
0N/A Flushes the given name from the view's DNS cache
0N/A and, if applicable, from the view's nameserver address
0N/A database, bad server cache and SERVFAIL cache.
0N/A <
term><
userinput>flushtree</
userinput> <
replaceable>name</
replaceable> <
optional><
replaceable>view</
replaceable></
optional> </
term>
0N/A Flushes the given name, and all of its subdomains,
0N/A from the view's DNS cache, address database,
0N/A bad server cache, and SERVFAIL cache.
0N/A <
term><
userinput>freeze <
optional><
replaceable>zone</
replaceable> <
optional><
replaceable>class</
replaceable> <
optional><
replaceable>view</
replaceable></
optional></
optional></
optional></
userinput></
term>
0N/A Suspend updates to a dynamic zone. If no zone is
0N/A specified, then all zones are suspended. This allows
0N/A manual edits to be made to a zone normally updated by
0N/A dynamic update. It also causes changes in the
0N/A journal file to be synced into the master file.
0N/A All dynamic update attempts will be refused while
0N/A See also <
command>rndc thaw</
command>.
0N/A <
term><
userinput>halt <
optional>-p</
optional></
userinput></
term>
0N/A Stop the server immediately. Recent changes
0N/A made through dynamic update or IXFR are not saved to
0N/A the master files, but will be rolled forward from the
0N/A journal files when the server is restarted.
0N/A If <
option>-p</
option> is specified <
command>named</
command>'s process id is returned.
0N/A This allows an external process to determine when <
command>named</
command>
0N/A had completed halting.
0N/A See also <
command>rndc stop</
command>.
0N/A <
term><
userinput>loadkeys <
replaceable>zone</
replaceable> <
optional><
replaceable>class</
replaceable> <
optional><
replaceable>view</
replaceable></
optional></
optional></
userinput></
term>
0N/A Fetch all DNSSEC keys for the given zone
0N/A from the key directory. If they are within
0N/A their publication period, merge them into the
0N/A zone's DNSKEY RRset. Unlike <
command>rndc
0N/A sign</
command>, however, the zone is not
0N/A immediately re-signed by the new keys, but is
0N/A allowed to incrementally re-sign over time.
0N/A This command requires that the
0N/A <
command>auto-dnssec</
command> zone option
0N/A be set to <
literal>maintain</
literal>,
0N/A and also requires the zone to be configured to
0N/A (See "Dynamic Update Policies" in the Administrator
0N/A Reference Manual for more details.)
0N/A <
term><
userinput>managed-keys <
replaceable>(status | refresh | sync)</
replaceable> <
optional><
replaceable>class</
replaceable> <
optional><
replaceable>view</
replaceable></
optional></
optional></
userinput></
term>
0N/A When run with the "status" keyword, print the current
0N/A status of the managed-keys database for the specified
0N/A view, or for all views if none is specified. When run
0N/A with the "refresh" keyword, force an immediate refresh
0N/A of all the managed-keys in the specified view, or all
0N/A views. When run with the "sync" keyword, force an
0N/A immediate dump of the managed-keys database to disk (in
0N/A (<
filename><
replaceable>viewname</
replaceable>.mkeys</
filename>).
0N/A <
term><
userinput>modzone <
replaceable>zone</
replaceable> <
optional><
replaceable>class</
replaceable> <
optional><
replaceable>view</
replaceable></
optional></
optional> <
replaceable>configuration</
replaceable> </
userinput></
term>
0N/A Modify the configuration of a zone while the server
0N/A is running. This command requires the
0N/A <
command>allow-new-zones</
command> option to be
0N/A set to <
userinput>yes</
userinput>. As with
0N/A <
command>addzone</
command>, the
0N/A <
replaceable>configuration</
replaceable> string
0N/A specified on the command line is the zone
0N/A configuration text that would ordinarily be
0N/A If the zone was originally added via
0N/A <
command>rndc addzone</
command>, the configuration
0N/A changes will be recorded permanently and will still be
0N/A in effect after the server is restarted or reconfigured.
0N/A However, if it was originally configured in
0N/A configuration is still in place; when the server is
0N/A restarted or reconfigured, the zone will revert to
0N/A its original configuration. To make the changes
0N/A permanent, it must also be modified in
0N/A See also <
command>rndc addzone</
command> and <
command>rndc delzone</
command>.
0N/A <
term><
userinput>notify <
replaceable>zone</
replaceable> <
optional><
replaceable>class</
replaceable> <
optional><
replaceable>view</
replaceable></
optional></
optional></
userinput></
term>
0N/A Resend NOTIFY messages for the zone.
0N/A <
term><
userinput>notrace</
userinput></
term>
0N/A Sets the server's debugging level to 0.
0N/A See also <
command>rndc trace</
command>.
2548N/A <
optional>( -d | -f | -r | -l <
replaceable>duration</
replaceable>)</
optional>
2548N/A <
replaceable>domain</
replaceable>
2548N/A <
optional><
replaceable>view</
replaceable></
optional>
2548N/A Sets a DNSSEC negative trust anchor (NTA)
2548N/A for <
option>domain</
option>, with a lifetime of
2548N/A <
option>duration</
option>. The default lifetime is
2548N/A <
option>nta-lifetime</
option> option, and defaults to
2548N/A one hour. The lifetime cannot exceed one week.
2548N/A A negative trust anchor selectively disables
2548N/A DNSSEC validation for zones that are known to be
2548N/A failing because of misconfiguration rather than
2548N/A an attack. When data to be validated is
2548N/A at or below an active NTA (and above any other
2548N/A configured trust anchors), <
command>named</
command> will
2548N/A abort the DNSSEC validation process and treat the data as
2548N/A insecure rather than bogus. This continues until the
2548N/A NTAs persist across restarts of the <
command>named</
command> server.
2548N/A The NTAs for a view are saved in a file called
2548N/A <
filename><
replaceable>name</
replaceable>.nta</
filename>,
2548N/A where <
replaceable>name</
replaceable> is the
2548N/A name of the view, or if it contains characters
2548N/A that are incompatible with use as a file name, a
2548N/A cryptographic hash generated from the name
2548N/A An existing NTA can be removed by using the
2548N/A <
option>-remove</
option> option.
2548N/A An NTA's lifetime can be specified with the
2548N/A <
option>-lifetime</
option> option. TTL-style
2548N/A suffixes can be used to specify the lifetime in
2548N/A seconds, minutes, or hours. If the specified NTA
0N/A already exists, its lifetime will be updated to the
0N/A new value. Setting <
option>lifetime</
option> to zero
0N/A is equivalent to <
option>-remove</
option>.
0N/A If <
option>-dump</
option> is used, any other arguments
0N/A are ignored, and a list of existing NTAs is printed
0N/A (note that this may include NTAs that are expired but
0N/A have not yet been cleaned up).
2548N/A Normally, <
command>named</
command> will periodically
2548N/A test to see whether data below an NTA can now be
2548N/A validated (see the <
option>nta-recheck</
option> option
2548N/A in the Administrator Reference Manual for details).
2548N/A If data can be validated, then the NTA is regarded as
2548N/A no longer necessary, and will be allowed to expire
2548N/A early. The <
option>-force</
option> overrides this
2548N/A behavior and forces an NTA to persist for its entire
2548N/A lifetime, regardless of whether data could be
0N/A validated if the NTA were not present.
2548N/A All of these options can be shortened,
i.e., to
0N/A <
option>-l</
option>, <
option>-r</
option>, <
option>-d</
option>,
0N/A <
term><
userinput>querylog</
userinput> <
optional>on|off</
optional> </
term>
0N/A Enable or disable query logging. (For backward
0N/A compatibility, this command can also be used without
0N/A an argument to toggle query logging on and off.)
0N/A Query logging can also be enabled
2548N/A by explicitly directing the <
command>queries</
command>
2548N/A <
command>category</
command> to a
2548N/A <
command>channel</
command> in the
2548N/A <
command>logging</
command> section of
2548N/A <
command>querylog yes;</
command> in the
2548N/A <
command>options</
command> section of
2548N/A <
term><
userinput>reconfig</
userinput></
term>
2548N/A Reload the configuration file and load new zones,
2548N/A but do not reload existing zone files even if they
2548N/A This is faster than a full <
command>reload</
command> when there
2548N/A is a large number of zones because it avoids the need
2548N/A modification times of the zones files.
2548N/A <
term><
userinput>recursing</
userinput></
term>
2548N/A Dump the list of queries <
command>named</
command> is currently
2548N/A recursing on, and the list of domains to which iterative
2548N/A queries are currently being sent. (The second list includes
2548N/A the number of fetches currently active for the given domain,
0N/A and how many have been passed or dropped because of the
0N/A <
option>fetches-per-zone</
option> option.)
0N/A <
term><
userinput>refresh <
replaceable>zone</
replaceable> <
optional><
replaceable>class</
replaceable> <
optional><
replaceable>view</
replaceable></
optional></
optional></
userinput></
term>
0N/A Schedule zone maintenance for the given zone.
2548N/A <
term><
userinput>reload</
userinput></
term>
2548N/A Reload configuration file and zones.
0N/A <
term><
userinput>reload <
replaceable>zone</
replaceable> <
optional><
replaceable>class</
replaceable> <
optional><
replaceable>view</
replaceable></
optional></
optional></
userinput></
term>
2548N/A <
term><
userinput>retransfer <
replaceable>zone</
replaceable> <
optional><
replaceable>class</
replaceable> <
optional><
replaceable>view</
replaceable></
optional></
optional></
userinput></
term>
2548N/A Retransfer the given slave zone from the master server.
2548N/A If the zone is configured to use
2548N/A <
command>inline-signing</
command>, the signed
2548N/A version of the zone is discarded; after the
2548N/A retransfer of the unsigned version is complete, the
0N/A signed version will be regenerated with all new
2548N/A <
term><
userinput>scan</
userinput></
term>
2548N/A Scan the list of available network interfaces
2548N/A for changes, without performing a full
0N/A <
command>reconfig</
command> or waiting for the
0N/A <
command>interface-interval</
command> timer.
0N/A <
term><
userinput>secroots <
optional>-</
optional> <
optional><
replaceable>view ...</
replaceable></
optional></
userinput></
term>
0N/A Dump the server's security roots and negative trust anchors
0N/A for the specified views. If no view is specified, all views
0N/A If the first argument is "-", then the output is
0N/A returned via the <
command>rndc</
command> response channel
0N/A and printed to the standard output.
0N/A Otherwise, it is written to the secroots dump file, which
0N/A overridden via the <
option>secroots-file</
option> option in
0N/A See also <
command>rndc managed-keys</
command>.
0N/A <
term><
userinput>showzone <
replaceable>zone</
replaceable> <
optional><
replaceable>class</
replaceable> <
optional><
replaceable>view</
replaceable></
optional></
optional> </
userinput></
term>
0N/A Print the configuration of a running zone.
0N/A See also <
command>rndc zonestatus</
command>.
0N/A <
term><
userinput>sign <
replaceable>zone</
replaceable> <
optional><
replaceable>class</
replaceable> <
optional><
replaceable>view</
replaceable></
optional></
optional></
userinput></
term>
0N/A Fetch all DNSSEC keys for the given zone
0N/A from the key directory (see the
0N/A <
command>key-directory</
command> option in
0N/A the BIND 9 Administrator Reference Manual). If they are within
0N/A their publication period, merge them into the
0N/A zone's DNSKEY RRset. If the DNSKEY RRset
0N/A is changed, then the zone is automatically
0N/A re-signed with the new key set.
0N/A This command requires that the
0N/A <
command>auto-dnssec</
command> zone option be set
0N/A to <
literal>allow</
literal> or
0N/A <
literal>maintain</
literal>,
0N/A and also requires the zone to be configured to
0N/A (See "Dynamic Update Policies" in the Administrator
0N/A Reference Manual for more details.)
0N/A See also <
command>rndc loadkeys</
command>.
0N/A <
term><
userinput>signing <
optional>( -list | -clear <
replaceable>
keyid/
algorithm</
replaceable> | -clear <
literal>all</
literal> | -nsec3param ( <
replaceable>parameters</
replaceable> | <
literal>none</
literal> ) | -serial <
replaceable>value</
replaceable> ) </
optional> <
replaceable>zone</
replaceable> <
optional><
replaceable>class</
replaceable> <
optional><
replaceable>view</
replaceable></
optional></
optional> </
userinput></
term>
0N/A List, edit, or remove the DNSSEC signing state records
0N/A for the specified zone. The status of ongoing DNSSEC
0N/A operations (such as signing or generating
0N/A NSEC3 chains) is stored in the zone in the form
0N/A of DNS resource records of type
0N/A <
command>sig-signing-type</
command>.
0N/A <
command>rndc signing -list</
command> converts
0N/A these records into a human-readable form,
0N/A indicating which keys are currently signing
0N/A or have finished signing the zone, and which NSEC3
0N/A chains are being created or removed.
0N/A <
command>rndc signing -clear</
command> can remove
1271N/A a single key (specified in the same format that
0N/A <
command>rndc signing -list</
command> uses to
0N/A display it), or all keys. In either case, only
0N/A completed keys are removed; any record indicating
0N/A that a key has not yet finished signing the zone
0N/A <
command>rndc signing -nsec3param</
command> sets
0N/A the NSEC3 parameters for a zone. This is the
0N/A only supported mechanism for using NSEC3 with
1271N/A <
command>inline-signing</
command> zones.
0N/A Parameters are specified in the same format as
2548N/A an NSEC3PARAM resource record: hash algorithm,
2548N/A flags, iterations, and salt, in that order.
2548N/A Currently, the only defined value for hash algorithm
2548N/A is <
literal>1</
literal>, representing SHA-1.
2548N/A The <
option>flags</
option> may be set to
2548N/A <
literal>0</
literal> or <
literal>1</
literal>,
2548N/A depending on whether you wish to set the opt-out
2548N/A bit in the NSEC3 chain. <
option>iterations</
option>
2548N/A defines the number of additional times to apply
2548N/A the algorithm when generating an NSEC3 hash. The
2548N/A <
option>salt</
option> is a string of data expressed
2548N/A in hexadecimal, a hyphen (`-') if no salt is
2548N/A to be used, or the keyword <
literal>auto</
literal>,
2548N/A which causes <
command>named</
command> to generate a
0N/A So, for example, to create an NSEC3 chain using
0N/A the SHA-1 hash algorithm, no opt-out flag,
0N/A 10 iterations, and a salt value of "FFFF", use:
2548N/A <
command>rndc signing -nsec3param 1 0 10 FFFF <
replaceable>zone</
replaceable></
command>.
2548N/A To set the opt-out flag, 15 iterations, and no
2548N/A <
command>rndc signing -nsec3param 1 1 15 - <
replaceable>zone</
replaceable></
command>.
2548N/A <
command>rndc signing -nsec3param none</
command>
2548N/A removes an existing NSEC3 chain and replaces it
2548N/A <
command>rndc signing -serial value</
command> sets
2548N/A the serial number of the zone to value. If the value
2548N/A would cause the serial number to go backwards it will
2548N/A be rejected. The primary use is to set the serial on
2548N/A <
term><
userinput>stats</
userinput></
term>
2548N/A Write server statistics to the statistics file.
2548N/A (See the <
command>statistics-file</
command> option in
2548N/A the BIND 9 Administrator Reference Manual.)
2548N/A <
term><
userinput>status</
userinput></
term>
Display status of the server.
Note that the number of zones includes the internal <
command>
bind/
CH</
command> zone
and the default <
command>/
IN</
command>
hint zone if there is not an
explicit root zone configured.
<
term><
userinput>stop <
optional>-p</
optional></
userinput></
term>
Stop the server, making sure any recent changes
made through dynamic update or IXFR are first saved to
the master files of the updated zones.
If <
option>-p</
option> is specified <
command>named</
command>'s process id is returned.
This allows an external process to determine when <
command>named</
command>
<
para>See also <
command>rndc halt</
command>.</
para>
<
term><
userinput>sync <
optional>-clean</
optional> <
optional><
replaceable>zone</
replaceable> <
optional><
replaceable>class</
replaceable> <
optional><
replaceable>view</
replaceable></
optional></
optional></
optional></
userinput></
term>
Sync changes in the journal file for a dynamic zone
to the master file. If the "-clean" option is
specified, the journal file is also removed. If
no zone is specified, then all zones are synced.
<
term><
userinput>thaw <
optional><
replaceable>zone</
replaceable> <
optional><
replaceable>class</
replaceable> <
optional><
replaceable>view</
replaceable></
optional></
optional></
optional></
userinput></
term>
Enable updates to a frozen dynamic zone. If no
zone is specified, then all frozen zones are
enabled. This causes the server to reload the zone
from disk, and re-enables dynamic updates after the
load has completed. After a zone is thawed,
dynamic updates will no longer be refused. If
the zone has changed and the
<
command>ixfr-from-differences</
command> option is
in use, then the journal file will be updated to
reflect changes in the zone. Otherwise, if the
zone has changed, any existing journal file will be
<
para>See also <
command>rndc freeze</
command>.</
para>
<
term><
userinput>trace</
userinput></
term>
Increment the servers debugging level by one.
<
term><
userinput>trace <
replaceable>level</
replaceable></
userinput></
term>
Sets the server's debugging level to an explicit
See also <
command>rndc notrace</
command>.
<
term><
userinput>tsig-delete</
userinput> <
replaceable>keyname</
replaceable> <
optional><
replaceable>view</
replaceable></
optional></
term>
Delete a given TKEY-negotiated key from the server.
(This does not apply to statically configured TSIG
<
term><
userinput>tsig-list</
userinput></
term>
List the names of all TSIG keys currently configured
for use by <
command>named</
command> in each view. The
list both statically configured keys and dynamic
<
term><
userinput>validation ( on | off | check ) <
optional><
replaceable>view ...</
replaceable></
optional> </
userinput></
term>
Enable, disable, or check the current status of
Note <
command>dnssec-enable</
command> also needs to be
set to <
userinput>yes</
userinput> or
<
userinput>auto</
userinput> to be effective.
<
term><
userinput>zonestatus <
replaceable>zone</
replaceable> <
optional><
replaceable>class</
replaceable> <
optional><
replaceable>view</
replaceable></
optional></
optional></
userinput></
term>
Displays the current status of the given zone,
including the master file name and any include
files from which it was loaded, when it was most
recently loaded, the current serial number, the
number of nodes, whether the zone supports
dynamic updates, whether the zone is DNSSEC
signed, whether it uses automatic DNSSEC key
management or inline signing, and the scheduled
refresh or expiry times for the zone.
See also <
command>rndc showzone</
command>.
<
refsection><
info><
title>LIMITATIONS</
title></
info>
There is currently no way to provide the shared secret for a
<
option>key_id</
option> without using the configuration file.
Several error messages could be clearer.
<
refsection><
info><
title>SEE ALSO</
title></
info>
<
refentrytitle>
rndc.conf</
refentrytitle><
manvolnum>5</
manvolnum>
<
refentrytitle>rndc-confgen</
refentrytitle><
manvolnum>8</
manvolnum>
<
refentrytitle>named</
refentrytitle><
manvolnum>8</
manvolnum>
<
refentrytitle>
named.conf</
refentrytitle><
manvolnum>5</
manvolnum>
<
refentrytitle>ndc</
refentrytitle><
manvolnum>8</
manvolnum>
<
citetitle>BIND 9 Administrator Reference Manual</
citetitle>.