rndc.html revision 659d063f23a35d77ad5826e6556d3137672bb937
5cd4555ad444fd391002ae32450572054369fd42Rob Austein - Copyright (C) 2004, 2005, 2007, 2013-2015 Internet Systems Consortium, Inc. ("ISC")
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein - Copyright (C) 2000, 2001 Internet Software Consortium.
c1a883f2e04d94e99c433b1f6cfd0c0338f4ed85Mark Andrews - Permission to use, copy, modify, and/or distribute this software for any
689023771c563d8660e45d439a207e06e96de28fMark Andrews - purpose with or without fee is hereby granted, provided that the above
ec5347e2c775f027573ce5648b910361aa926c01Automatic Updater - copyright notice and this permission notice appear in all copies.
689023771c563d8660e45d439a207e06e96de28fMark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
689023771c563d8660e45d439a207e06e96de28fMark Andrews - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
689023771c563d8660e45d439a207e06e96de28fMark Andrews - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
689023771c563d8660e45d439a207e06e96de28fMark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
689023771c563d8660e45d439a207e06e96de28fMark Andrews - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
689023771c563d8660e45d439a207e06e96de28fMark Andrews - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
689023771c563d8660e45d439a207e06e96de28fMark Andrews - PERFORMANCE OF THIS SOFTWARE.
689023771c563d8660e45d439a207e06e96de28fMark Andrews<!-- $Id$ -->
ca84283333d22c64abfbcb87872dd5e6d9172c5aMark Andrews<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
689023771c563d8660e45d439a207e06e96de28fMark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
689023771c563d8660e45d439a207e06e96de28fMark Andrews<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
689023771c563d8660e45d439a207e06e96de28fMark Andrews<a name="man.rndc"></a><div class="titlepage"></div>
689023771c563d8660e45d439a207e06e96de28fMark Andrews<p><span class="application">rndc</span> — name server control utility</p>
689023771c563d8660e45d439a207e06e96de28fMark Andrews<div class="cmdsynopsis"><p><code class="command">rndc</code> [<code class="option">-b <em class="replaceable"><code>source-address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key-file</code></em></code>] [<code class="option">-s <em class="replaceable"><code>server</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-q</code>] [<code class="option">-V</code>] [<code class="option">-y <em class="replaceable"><code>key_id</code></em></code>] {command}</p></div>
689023771c563d8660e45d439a207e06e96de28fMark Andrews<p><span><strong class="command">rndc</strong></span>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein controls the operation of a name
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein server. It supersedes the <span><strong class="command">ndc</strong></span> utility
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein that was provided in old BIND releases. If
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <span><strong class="command">rndc</strong></span> is invoked with no command line
acb4f5236966c2b680b949c1eda826948b24fc23Mark Andrews options or arguments, it prints a short summary of the
c1a883f2e04d94e99c433b1f6cfd0c0338f4ed85Mark Andrews supported commands and the available options and their
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein<p><span><strong class="command">rndc</strong></span>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein communicates with the name server over a TCP connection, sending
689023771c563d8660e45d439a207e06e96de28fMark Andrews commands authenticated with digital signatures. In the current
689023771c563d8660e45d439a207e06e96de28fMark Andrews <span><strong class="command">rndc</strong></span> and <span><strong class="command">named</strong></span>,
689023771c563d8660e45d439a207e06e96de28fMark Andrews the only supported authentication algorithms are HMAC-MD5
689023771c563d8660e45d439a207e06e96de28fMark Andrews (for compatibility), HMAC-SHA1, HMAC-SHA224, HMAC-SHA256
689023771c563d8660e45d439a207e06e96de28fMark Andrews (default), HMAC-SHA384 and HMAC-SHA512.
689023771c563d8660e45d439a207e06e96de28fMark Andrews They use a shared secret on each end of the connection.
689023771c563d8660e45d439a207e06e96de28fMark Andrews This provides TSIG-style authentication for the command
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein request and the name server's response. All commands sent
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein over the channel must be signed by a key_id known to the
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein<p><span><strong class="command">rndc</strong></span>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein reads a configuration file to
689023771c563d8660e45d439a207e06e96de28fMark Andrews determine how to contact the name server and decide what
689023771c563d8660e45d439a207e06e96de28fMark Andrews algorithm and key it should use.
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term">-b <em class="replaceable"><code>source-address</code></em></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Use <em class="replaceable"><code>source-address</code></em>
689023771c563d8660e45d439a207e06e96de28fMark Andrews as the source address for the connection to the server.
689023771c563d8660e45d439a207e06e96de28fMark Andrews Multiple instances are permitted to allow setting of both
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein the IPv4 and IPv6 source addresses.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein<dt><span class="term">-c <em class="replaceable"><code>config-file</code></em></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Use <em class="replaceable"><code>config-file</code></em>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein as the configuration file instead of the default,
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein<dt><span class="term">-k <em class="replaceable"><code>key-file</code></em></span></dt>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Use <em class="replaceable"><code>key-file</code></em>
689023771c563d8660e45d439a207e06e96de28fMark Andrews as the key file instead of the default,
689023771c563d8660e45d439a207e06e96de28fMark Andrews <code class="filename">/etc/rndc.key</code>. The key in
689023771c563d8660e45d439a207e06e96de28fMark Andrews <code class="filename">/etc/rndc.key</code> will be used to
689023771c563d8660e45d439a207e06e96de28fMark Andrews authenticate
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein commands sent to the server if the <em class="replaceable"><code>config-file</code></em>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein does not exist.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein<dt><span class="term">-s <em class="replaceable"><code>server</code></em></span></dt>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein<dd><p><em class="replaceable"><code>server</code></em> is
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein the name or address of the server which matches a
689023771c563d8660e45d439a207e06e96de28fMark Andrews server statement in the configuration file for
689023771c563d8660e45d439a207e06e96de28fMark Andrews <span><strong class="command">rndc</strong></span>. If no server is supplied on the
689023771c563d8660e45d439a207e06e96de28fMark Andrews command line, the host named by the default-server clause
689023771c563d8660e45d439a207e06e96de28fMark Andrews in the options statement of the <span><strong class="command">rndc</strong></span>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein configuration file will be used.
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Send commands to TCP port
689023771c563d8660e45d439a207e06e96de28fMark Andrews of BIND 9's default control channel port, 953.
689023771c563d8660e45d439a207e06e96de28fMark Andrews Quiet mode: Message text returned by the server
689023771c563d8660e45d439a207e06e96de28fMark Andrews will not be printed except when there is an error.
689023771c563d8660e45d439a207e06e96de28fMark Andrews Enable verbose logging.
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term">-y <em class="replaceable"><code>key_id</code></em></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Use the key <em class="replaceable"><code>key_id</code></em>
689023771c563d8660e45d439a207e06e96de28fMark Andrews from the configuration file.
689023771c563d8660e45d439a207e06e96de28fMark Andrews <em class="replaceable"><code>key_id</code></em>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein known by named with the same algorithm and secret string
689023771c563d8660e45d439a207e06e96de28fMark Andrews in order for control message validation to succeed.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein If no <em class="replaceable"><code>key_id</code></em>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein is specified, <span><strong class="command">rndc</strong></span> will first look
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein for a key clause in the server statement of the server
689023771c563d8660e45d439a207e06e96de28fMark Andrews being used, or if no server statement is present for that
689023771c563d8660e45d439a207e06e96de28fMark Andrews host, then the default-key clause of the options statement.
689023771c563d8660e45d439a207e06e96de28fMark Andrews Note that the configuration file contains shared secrets
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein which are used to send authenticated control commands
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein to name servers. It should therefore not have general read
689023771c563d8660e45d439a207e06e96de28fMark Andrews or write access.
689023771c563d8660e45d439a207e06e96de28fMark Andrews A list of commands supported by <span><strong class="command">rndc</strong></span> can
689023771c563d8660e45d439a207e06e96de28fMark Andrews be seen by running <span><strong class="command">rndc</strong></span> without arguments.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Currently supported commands are:
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein<dt><span class="term"><strong class="userinput"><code>reload</code></strong></span></dt>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Reload configuration file and zones.
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>reload <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Reload the given zone.
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>refresh <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Schedule zone maintenance for the given zone.
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>retransfer <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Retransfer the given slave zone from the master server.
689023771c563d8660e45d439a207e06e96de28fMark Andrews If the zone is configured to use
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <span><strong class="command">inline-signing</strong></span>, the signed
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein version of the zone is discarded; after the
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein retransfer of the unsigned version is complete, the
689023771c563d8660e45d439a207e06e96de28fMark Andrews signed version will be regenerated with all new
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>sign <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Fetch all DNSSEC keys for the given zone
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein from the key directory (see the
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <span><strong class="command">key-directory</strong></span> option in
689023771c563d8660e45d439a207e06e96de28fMark Andrews the BIND 9 Administrator Reference Manual). If they are within
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein their publication period, merge them into the
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein zone's DNSKEY RRset. If the DNSKEY RRset
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein is changed, then the zone is automatically
689023771c563d8660e45d439a207e06e96de28fMark Andrews re-signed with the new key set.
689023771c563d8660e45d439a207e06e96de28fMark Andrews This command requires that the
689023771c563d8660e45d439a207e06e96de28fMark Andrews <span><strong class="command">auto-dnssec</strong></span> zone option be set
689023771c563d8660e45d439a207e06e96de28fMark Andrews and also requires the zone to be configured to
689023771c563d8660e45d439a207e06e96de28fMark Andrews allow dynamic DNS.
689023771c563d8660e45d439a207e06e96de28fMark Andrews (See "Dynamic Update Policies" in the Administrator
689023771c563d8660e45d439a207e06e96de28fMark Andrews Reference Manual for more details.)
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>loadkeys <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Fetch all DNSSEC keys for the given zone
689023771c563d8660e45d439a207e06e96de28fMark Andrews from the key directory. If they are within
689023771c563d8660e45d439a207e06e96de28fMark Andrews their publication period, merge them into the
689023771c563d8660e45d439a207e06e96de28fMark Andrews zone's DNSKEY RRset. Unlike <span><strong class="command">rndc
689023771c563d8660e45d439a207e06e96de28fMark Andrews immediately re-signed by the new keys, but is
689023771c563d8660e45d439a207e06e96de28fMark Andrews allowed to incrementally re-sign over time.
689023771c563d8660e45d439a207e06e96de28fMark Andrews This command requires that the
689023771c563d8660e45d439a207e06e96de28fMark Andrews <span><strong class="command">auto-dnssec</strong></span> zone option
689023771c563d8660e45d439a207e06e96de28fMark Andrews be set to <code class="literal">maintain</code>,
689023771c563d8660e45d439a207e06e96de28fMark Andrews and also requires the zone to be configured to
689023771c563d8660e45d439a207e06e96de28fMark Andrews allow dynamic DNS.
689023771c563d8660e45d439a207e06e96de28fMark Andrews (See "Dynamic Update Policies" in the Administrator
689023771c563d8660e45d439a207e06e96de28fMark Andrews Reference Manual for more details.)
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>freeze [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Suspend updates to a dynamic zone. If no zone is
689023771c563d8660e45d439a207e06e96de28fMark Andrews specified, then all zones are suspended. This allows
689023771c563d8660e45d439a207e06e96de28fMark Andrews manual edits to be made to a zone normally updated by
689023771c563d8660e45d439a207e06e96de28fMark Andrews dynamic update. It also causes changes in the
819b98479eff49ed93f57f4d65eb0ffe72136adcMark Andrews journal file to be synced into the master file.
689023771c563d8660e45d439a207e06e96de28fMark Andrews All dynamic update attempts will be refused while
689023771c563d8660e45d439a207e06e96de28fMark Andrews the zone is frozen.
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>thaw [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Enable updates to a frozen dynamic zone. If no
689023771c563d8660e45d439a207e06e96de28fMark Andrews zone is specified, then all frozen zones are
689023771c563d8660e45d439a207e06e96de28fMark Andrews enabled. This causes the server to reload the zone
689023771c563d8660e45d439a207e06e96de28fMark Andrews from disk, and re-enables dynamic updates after the
689023771c563d8660e45d439a207e06e96de28fMark Andrews load has completed. After a zone is thawed,
689023771c563d8660e45d439a207e06e96de28fMark Andrews dynamic updates will no longer be refused. If
689023771c563d8660e45d439a207e06e96de28fMark Andrews the zone has changed and the
689023771c563d8660e45d439a207e06e96de28fMark Andrews <span><strong class="command">ixfr-from-differences</strong></span> option is
689023771c563d8660e45d439a207e06e96de28fMark Andrews in use, then the journal file will be updated to
ffcc1bdb3635ef9c6992b9c24d7c85ebab2c393bMark Andrews reflect changes in the zone. Otherwise, if the
ffcc1bdb3635ef9c6992b9c24d7c85ebab2c393bMark Andrews zone has changed, any existing journal file will be
281bab0f36eaedc56f859721fbdf45568b71cd60Mark Andrews<dt><span class="term"><strong class="userinput"><code>scan</code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Scan the list of available network interfaces
689023771c563d8660e45d439a207e06e96de28fMark Andrews for changes, without performing a full
689023771c563d8660e45d439a207e06e96de28fMark Andrews <span><strong class="command">reconfig</strong></span> or waiting for the
689023771c563d8660e45d439a207e06e96de28fMark Andrews <span><strong class="command">interface-interval</strong></span> timer.
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>sync [<span class="optional">-clean</span>] [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
fd780f3d47179d68ba2d4661fb9cac9ce1e74928Mark Andrews Sync changes in the journal file for a dynamic zone
fd780f3d47179d68ba2d4661fb9cac9ce1e74928Mark Andrews to the master file. If the "-clean" option is
689023771c563d8660e45d439a207e06e96de28fMark Andrews specified, the journal file is also removed. If
689023771c563d8660e45d439a207e06e96de28fMark Andrews no zone is specified, then all zones are synced.
dc6da18ccbb808d21f123cc6bda399b44ad11445Mark Andrews<dt><span class="term"><strong class="userinput"><code>notify <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
dc6da18ccbb808d21f123cc6bda399b44ad11445Mark Andrews Resend NOTIFY messages for the zone.
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>reconfig</code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Reload the configuration file and load new zones,
689023771c563d8660e45d439a207e06e96de28fMark Andrews but do not reload existing zone files even if they
689023771c563d8660e45d439a207e06e96de28fMark Andrews have changed.
689023771c563d8660e45d439a207e06e96de28fMark Andrews This is faster than a full <span><strong class="command">reload</strong></span> when there
fabf2ee6b01ee06a0de940b83d53cf57f9f79265Mark Andrews is a large number of zones because it avoids the need
689023771c563d8660e45d439a207e06e96de28fMark Andrews to examine the
08c90261660649ca7d92065f6f13a61ec5a9a86dMark Andrews modification times of the zones files.
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>zonestatus [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
cfe92110ce4eaf19f7f3255d2961710879bdc9ddMark Andrews Displays the current status of the given zone,
689023771c563d8660e45d439a207e06e96de28fMark Andrews including the master file name and any include
689023771c563d8660e45d439a207e06e96de28fMark Andrews files from which it was loaded, when it was most
fabf2ee6b01ee06a0de940b83d53cf57f9f79265Mark Andrews recently loaded, the current serial number, the
689023771c563d8660e45d439a207e06e96de28fMark Andrews number of nodes, whether the zone supports
6b79e960e6ba2991aeb02a6c39af255ab7f06d99Mark Andrews dynamic updates, whether the zone is DNSSEC
6b79e960e6ba2991aeb02a6c39af255ab7f06d99Mark Andrews signed, whether it uses automatic DNSSEC key
6b79e960e6ba2991aeb02a6c39af255ab7f06d99Mark Andrews management or inline signing, and the scheduled
6b79e960e6ba2991aeb02a6c39af255ab7f06d99Mark Andrews refresh or expiry times for the zone.
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>managed-keys <em class="replaceable"><code>(status | refresh | sync)</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews When run with the "status" keyword, print the current
689023771c563d8660e45d439a207e06e96de28fMark Andrews status of the managed-keys database for the specified
819b98479eff49ed93f57f4d65eb0ffe72136adcMark Andrews view, or for all views if none is specified. When run
49210da3fb6a9268725b2a7db864ade531e5d403Mark Andrews with the "refresh" keyword, force an immediate refresh
819b98479eff49ed93f57f4d65eb0ffe72136adcMark Andrews of all the managed-keys in the specified view, or all
689023771c563d8660e45d439a207e06e96de28fMark Andrews views. When run with the "sync" keyword, force an
73fb13fe97cf2f1d93d5e2ea56583fdb2f40b6f3Mark Andrews immediate dump of the managed-keys database to disk (in
689023771c563d8660e45d439a207e06e96de28fMark Andrews the file <code class="filename">managed-keys.bind</code> or
59d84d1b077678cb77f6cbcc53d8cfa60ff69cb7Mark Andrews (<code class="filename"><em class="replaceable"><code>viewname</code></em>.mkeys</code>).
982b1c2bf53900e87a7efe15ade9fa44e30372a1Mark Andrews<dt><span class="term"><strong class="userinput"><code>stats</code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Write server statistics to the statistics file.
48f929d315bafeeffe0a37082ab4c9661a928c39Mark Andrews<dt><span class="term"><strong class="userinput"><code>querylog</code></strong> [<span class="optional">on|off</span>] </span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Enable or disable query logging. (For backward
689023771c563d8660e45d439a207e06e96de28fMark Andrews compatibility, this command can also be used without
689023771c563d8660e45d439a207e06e96de28fMark Andrews an argument to toggle query logging on and off.)
689023771c563d8660e45d439a207e06e96de28fMark Andrews Query logging can also be enabled
689023771c563d8660e45d439a207e06e96de28fMark Andrews by explicitly directing the <span><strong class="command">queries</strong></span>
689023771c563d8660e45d439a207e06e96de28fMark Andrews <span><strong class="command">category</strong></span> to a
689023771c563d8660e45d439a207e06e96de28fMark Andrews <span><strong class="command">channel</strong></span> in the
689023771c563d8660e45d439a207e06e96de28fMark Andrews <span><strong class="command">logging</strong></span> section of
689023771c563d8660e45d439a207e06e96de28fMark Andrews <code class="filename">named.conf</code> or by specifying
689023771c563d8660e45d439a207e06e96de28fMark Andrews <span><strong class="command">querylog yes;</strong></span> in the
689023771c563d8660e45d439a207e06e96de28fMark Andrews <span><strong class="command">options</strong></span> section of
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>dumpdb [<span class="optional">-all|-cache|-zone</span>] [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Dump the server's caches (default) and/or zones to
689023771c563d8660e45d439a207e06e96de28fMark Andrews dump file for the specified views. If no view is
689023771c563d8660e45d439a207e06e96de28fMark Andrews specified, all
689023771c563d8660e45d439a207e06e96de28fMark Andrews views are dumped.
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>secroots [<span class="optional">-</span>] [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Dump the server's security roots and negative trust anchors
689023771c563d8660e45d439a207e06e96de28fMark Andrews for the specified views. If no view is specified, all views
689023771c563d8660e45d439a207e06e96de28fMark Andrews If the first argument is "-", then the output is
a45a6ea2b03448751d7c44931e8ac7666e7cc2ceMark Andrews returned via the <span><strong class="command">rndc</strong></span> response channel
a1bc94109313bf4ebb6e6ff655d71d45582d2e43Mark Andrews and printed to the standard output.
a1bc94109313bf4ebb6e6ff655d71d45582d2e43Mark Andrews Otherwise, it is written to the secroots dump file, which
689023771c563d8660e45d439a207e06e96de28fMark Andrews defaults to <code class="filename">named.secroots</code>, but can be
689023771c563d8660e45d439a207e06e96de28fMark Andrews overridden via the <code class="option">secroots-file</code> option in
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>stop [<span class="optional">-p</span>]</code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Stop the server, making sure any recent changes
689023771c563d8660e45d439a207e06e96de28fMark Andrews made through dynamic update or IXFR are first saved to
689023771c563d8660e45d439a207e06e96de28fMark Andrews the master files of the updated zones.
689023771c563d8660e45d439a207e06e96de28fMark Andrews If <code class="option">-p</code> is specified <span><strong class="command">named</strong></span>'s process id is returned.
689023771c563d8660e45d439a207e06e96de28fMark Andrews This allows an external process to determine when <span><strong class="command">named</strong></span>
689023771c563d8660e45d439a207e06e96de28fMark Andrews had completed stopping.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein<dt><span class="term"><strong class="userinput"><code>halt [<span class="optional">-p</span>]</code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Stop the server immediately. Recent changes
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein made through dynamic update or IXFR are not saved to
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein the master files, but will be rolled forward from the
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein journal files when the server is restarted.
689023771c563d8660e45d439a207e06e96de28fMark Andrews If <code class="option">-p</code> is specified <span><strong class="command">named</strong></span>'s process id is returned.
689023771c563d8660e45d439a207e06e96de28fMark Andrews This allows an external process to determine when <span><strong class="command">named</strong></span>
689023771c563d8660e45d439a207e06e96de28fMark Andrews had completed halting.
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>trace</code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Increment the servers debugging level by one.
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>trace <em class="replaceable"><code>level</code></em></code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Sets the server's debugging level to an explicit
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>notrace</code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Sets the server's debugging level to 0.
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>flush</code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Flushes the server's cache.
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>flushname</code></strong> <em class="replaceable"><code>name</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>] </span></dt>
819b98479eff49ed93f57f4d65eb0ffe72136adcMark Andrews Flushes the given name from the view's DNS cache
689023771c563d8660e45d439a207e06e96de28fMark Andrews and, if applicable, from the view's nameserver address
689023771c563d8660e45d439a207e06e96de28fMark Andrews database, bad server cache and SERVFAIL cache.
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>flushtree</code></strong> <em class="replaceable"><code>name</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>] </span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Flushes the given name, and all of its subdomains,
689023771c563d8660e45d439a207e06e96de28fMark Andrews from the view's DNS cache, address database,
689023771c563d8660e45d439a207e06e96de28fMark Andrews bad server cache, and SERVFAIL cache.
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>status</code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Display status of the server.
689023771c563d8660e45d439a207e06e96de28fMark Andrews Note that the number of zones includes the internal <span><strong class="command">bind/CH</strong></span> zone
689023771c563d8660e45d439a207e06e96de28fMark Andrews and the default <span><strong class="command">/IN</strong></span>
ffcc1bdb3635ef9c6992b9c24d7c85ebab2c393bMark Andrews hint zone if there is not an
ffcc1bdb3635ef9c6992b9c24d7c85ebab2c393bMark Andrews explicit root zone configured.
281bab0f36eaedc56f859721fbdf45568b71cd60Mark Andrews<dt><span class="term"><strong class="userinput"><code>recursing</code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Dump the list of queries <span><strong class="command">named</strong></span> is currently recursing
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>validation ( on | off | check ) [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>] </code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Enable, disable, or check the current status of
689023771c563d8660e45d439a207e06e96de28fMark Andrews DNSSEC validation.
fd780f3d47179d68ba2d4661fb9cac9ce1e74928Mark Andrews Note <span><strong class="command">dnssec-enable</strong></span> also needs to be
fd780f3d47179d68ba2d4661fb9cac9ce1e74928Mark Andrews set to <strong class="userinput"><code>yes</code></strong> or
fd780f3d47179d68ba2d4661fb9cac9ce1e74928Mark Andrews <strong class="userinput"><code>auto</code></strong> to be effective.
689023771c563d8660e45d439a207e06e96de28fMark Andrews It defaults to enabled.
c5223c9cb7c22620d5ee6611228673e95b48a270Mark Andrews<dt><span class="term"><strong class="userinput"><code>nta
dc6da18ccbb808d21f123cc6bda399b44ad11445Mark Andrews [<span class="optional">( -d | -f | -r | -l <em class="replaceable"><code>duration</code></em>)</span>]
dc6da18ccbb808d21f123cc6bda399b44ad11445Mark Andrews <em class="replaceable"><code>domain</code></em>
dc6da18ccbb808d21f123cc6bda399b44ad11445Mark Andrews [<span class="optional"><em class="replaceable"><code>view</code></em></span>]
689023771c563d8660e45d439a207e06e96de28fMark Andrews Sets a DNSSEC negative trust anchor (NTA)
689023771c563d8660e45d439a207e06e96de28fMark Andrews for <code class="option">domain</code>, with a lifetime of
689023771c563d8660e45d439a207e06e96de28fMark Andrews <code class="option">duration</code>. The default lifetime is
689023771c563d8660e45d439a207e06e96de28fMark Andrews configured in <code class="filename">named.conf</code> via the
689023771c563d8660e45d439a207e06e96de28fMark Andrews <code class="option">nta-lifetime</code> option, and defaults to
689023771c563d8660e45d439a207e06e96de28fMark Andrews one hour. The lifetime cannot exceed one week.
689023771c563d8660e45d439a207e06e96de28fMark Andrews A negative trust anchor selectively disables
689023771c563d8660e45d439a207e06e96de28fMark Andrews DNSSEC validation for zones that are known to be
cfe92110ce4eaf19f7f3255d2961710879bdc9ddMark Andrews failing because of misconfiguration rather than
689023771c563d8660e45d439a207e06e96de28fMark Andrews an attack. When data to be validated is
689023771c563d8660e45d439a207e06e96de28fMark Andrews at or below an active NTA (and above any other
fabf2ee6b01ee06a0de940b83d53cf57f9f79265Mark Andrews configured trust anchors), <span><strong class="command">named</strong></span> will
6b79e960e6ba2991aeb02a6c39af255ab7f06d99Mark Andrews abort the DNSSEC validation process and treat the data as
6b79e960e6ba2991aeb02a6c39af255ab7f06d99Mark Andrews insecure rather than bogus. This continues until the
6b79e960e6ba2991aeb02a6c39af255ab7f06d99Mark Andrews NTA's lifetime is elapsed.
6b79e960e6ba2991aeb02a6c39af255ab7f06d99Mark Andrews NTAs persist across restarts of the named server.
689023771c563d8660e45d439a207e06e96de28fMark Andrews The NTAs for a view are saved in a file called
689023771c563d8660e45d439a207e06e96de28fMark Andrews <code class="filename"><em class="replaceable"><code>name</code></em>.nta</code>,
689023771c563d8660e45d439a207e06e96de28fMark Andrews where <em class="replaceable"><code>name</code></em> is the
689023771c563d8660e45d439a207e06e96de28fMark Andrews name of the view, or if it contains characters
819b98479eff49ed93f57f4d65eb0ffe72136adcMark Andrews that are incompatible with use as a file name, a
49210da3fb6a9268725b2a7db864ade531e5d403Mark Andrews cryptographic hash generated from the name
819b98479eff49ed93f57f4d65eb0ffe72136adcMark Andrews of the view.
689023771c563d8660e45d439a207e06e96de28fMark Andrews An existing NTA can be removed by using the
689023771c563d8660e45d439a207e06e96de28fMark Andrews An NTA's lifetime can be specified with the
689023771c563d8660e45d439a207e06e96de28fMark Andrews <code class="option">-lifetime</code> option. TTL-style
689023771c563d8660e45d439a207e06e96de28fMark Andrews suffixes can be used to specify the lifetime in
48f929d315bafeeffe0a37082ab4c9661a928c39Mark Andrews seconds, minutes, or hours. If the specified NTA
ca84283333d22c64abfbcb87872dd5e6d9172c5aMark Andrews already exists, its lifetime will be updated to the
689023771c563d8660e45d439a207e06e96de28fMark Andrews new value. Setting <code class="option">lifetime</code> to zero
689023771c563d8660e45d439a207e06e96de28fMark Andrews is equivalent to <code class="option">-remove</code>.
689023771c563d8660e45d439a207e06e96de28fMark Andrews If <code class="option">-dump</code> is used, any other arguments
689023771c563d8660e45d439a207e06e96de28fMark Andrews are ignored, and a list of existing NTAs is printed
689023771c563d8660e45d439a207e06e96de28fMark Andrews (note that this may include NTAs that are expired but
689023771c563d8660e45d439a207e06e96de28fMark Andrews have not yet been cleaned up).
689023771c563d8660e45d439a207e06e96de28fMark Andrews Normally, <span><strong class="command">named</strong></span> will periodically
689023771c563d8660e45d439a207e06e96de28fMark Andrews test to see whether data below an NTA can now be
689023771c563d8660e45d439a207e06e96de28fMark Andrews validated (see the <code class="option">nta-recheck</code> option
689023771c563d8660e45d439a207e06e96de28fMark Andrews in the Administrator Reference Manual for details).
689023771c563d8660e45d439a207e06e96de28fMark Andrews If data can be validated, then the NTA is regarded as
689023771c563d8660e45d439a207e06e96de28fMark Andrews no longer necessary, and will be allowed to expire
689023771c563d8660e45d439a207e06e96de28fMark Andrews early. The <code class="option">-force</code> overrides this
689023771c563d8660e45d439a207e06e96de28fMark Andrews behavior and forces an NTA to persist for its entire
689023771c563d8660e45d439a207e06e96de28fMark Andrews lifetime, regardless of whether data could be
689023771c563d8660e45d439a207e06e96de28fMark Andrews validated if the NTA were not present.
689023771c563d8660e45d439a207e06e96de28fMark Andrews All of these options can be shortened, i.e., to
689023771c563d8660e45d439a207e06e96de28fMark Andrews <code class="option">-l</code>, <code class="option">-r</code>, <code class="option">-d</code>,
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>tsig-list</code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews List the names of all TSIG keys currently configured
689023771c563d8660e45d439a207e06e96de28fMark Andrews for use by <span><strong class="command">named</strong></span> in each view. The
689023771c563d8660e45d439a207e06e96de28fMark Andrews list both statically configured keys and dynamic
689023771c563d8660e45d439a207e06e96de28fMark Andrews TKEY-negotiated keys.
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>tsig-delete</code></strong> <em class="replaceable"><code>keyname</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span></dt>
a1bc94109313bf4ebb6e6ff655d71d45582d2e43Mark Andrews Delete a given TKEY-negotiated key from the server.
689023771c563d8660e45d439a207e06e96de28fMark Andrews (This does not apply to statically configured TSIG
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>addzone <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] <em class="replaceable"><code>configuration</code></em> </code></strong></span></dt>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Add a zone while the server is running. This
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein command requires the
689023771c563d8660e45d439a207e06e96de28fMark Andrews <span><strong class="command">allow-new-zones</strong></span> option to be set
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein to <strong class="userinput"><code>yes</code></strong>. The
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <em class="replaceable"><code>configuration</code></em> string
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein specified on the command line is the zone
689023771c563d8660e45d439a207e06e96de28fMark Andrews configuration text that would ordinarily be
689023771c563d8660e45d439a207e06e96de28fMark Andrews placed in <code class="filename">named.conf</code>.
689023771c563d8660e45d439a207e06e96de28fMark Andrews The configuration is saved in a file called
689023771c563d8660e45d439a207e06e96de28fMark Andrews <code class="filename"><em class="replaceable"><code>name</code></em>.nzf</code>,
689023771c563d8660e45d439a207e06e96de28fMark Andrews where <em class="replaceable"><code>name</code></em> is the
689023771c563d8660e45d439a207e06e96de28fMark Andrews name of the view, or if it contains characters
689023771c563d8660e45d439a207e06e96de28fMark Andrews that are incompatible with use as a file name, a
689023771c563d8660e45d439a207e06e96de28fMark Andrews cryptographic hash generated from the name
689023771c563d8660e45d439a207e06e96de28fMark Andrews of the view.
689023771c563d8660e45d439a207e06e96de28fMark Andrews When <span><strong class="command">named</strong></span> is
689023771c563d8660e45d439a207e06e96de28fMark Andrews restarted, the file will be loaded into the view
689023771c563d8660e45d439a207e06e96de28fMark Andrews configuration, so that zones that were added
c5223c9cb7c22620d5ee6611228673e95b48a270Mark Andrews can persist after a restart.
dc6da18ccbb808d21f123cc6bda399b44ad11445Mark Andrews This sample <span><strong class="command">addzone</strong></span> command
689023771c563d8660e45d439a207e06e96de28fMark Andrews would add the zone <code class="literal">example.com</code>
689023771c563d8660e45d439a207e06e96de28fMark Andrews to the default view:
689023771c563d8660e45d439a207e06e96de28fMark Andrews<code class="prompt">$ </code><strong class="userinput"><code>rndc addzone example.com '{ type master; file "example.com.db"; };'</code></strong>
689023771c563d8660e45d439a207e06e96de28fMark Andrews (Note the brackets and semi-colon around the zone
689023771c563d8660e45d439a207e06e96de28fMark Andrews configuration text.)
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>modzone <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] <em class="replaceable"><code>configuration</code></em> </code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Modify the configuration of a zone while the server
59d84d1b077678cb77f6cbcc53d8cfa60ff69cb7Mark Andrews is running. This command requires the
689023771c563d8660e45d439a207e06e96de28fMark Andrews <span><strong class="command">allow-new-zones</strong></span> option to be
982b1c2bf53900e87a7efe15ade9fa44e30372a1Mark Andrews set to <strong class="userinput"><code>yes</code></strong>. As with
689023771c563d8660e45d439a207e06e96de28fMark Andrews <span><strong class="command">addzone</strong></span>, the
689023771c563d8660e45d439a207e06e96de28fMark Andrews <em class="replaceable"><code>configuration</code></em> string
689023771c563d8660e45d439a207e06e96de28fMark Andrews specified on the command line is the zone
48f929d315bafeeffe0a37082ab4c9661a928c39Mark Andrews configuration text that would ordinarily be
ca84283333d22c64abfbcb87872dd5e6d9172c5aMark Andrews placed in <code class="filename">named.conf</code>.
689023771c563d8660e45d439a207e06e96de28fMark Andrews If the zone was originally added via
689023771c563d8660e45d439a207e06e96de28fMark Andrews <span><strong class="command">rndc addzone</strong></span>, the configuration
689023771c563d8660e45d439a207e06e96de28fMark Andrews changes will be recorded permanently and will still be
689023771c563d8660e45d439a207e06e96de28fMark Andrews in effect after the server is restarted or reconfigured.
689023771c563d8660e45d439a207e06e96de28fMark Andrews However, if it was originally configured in
689023771c563d8660e45d439a207e06e96de28fMark Andrews <code class="filename">named.conf</code>, then that original
689023771c563d8660e45d439a207e06e96de28fMark Andrews configuration is still in place; when the server is
689023771c563d8660e45d439a207e06e96de28fMark Andrews restarted or reconfigured, the zone will revert to
689023771c563d8660e45d439a207e06e96de28fMark Andrews its original configuration. To make the changes
689023771c563d8660e45d439a207e06e96de28fMark Andrews permanent, it must also be modified in
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>delzone [<span class="optional">-clean</span>] <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] </code></strong></span></dt>
689023771c563d8660e45d439a207e06e96de28fMark Andrews Delete a zone while the server is running.
689023771c563d8660e45d439a207e06e96de28fMark Andrews If the <code class="option">-clean</code> is specified,
689023771c563d8660e45d439a207e06e96de28fMark Andrews the zone's master file (and journal file, if any)
689023771c563d8660e45d439a207e06e96de28fMark Andrews will be deleted along with the zone. Without the
689023771c563d8660e45d439a207e06e96de28fMark Andrews <code class="option">-clean</code> option, zone files must
689023771c563d8660e45d439a207e06e96de28fMark Andrews be cleaned up by hand. (If the zone is of
689023771c563d8660e45d439a207e06e96de28fMark Andrews type "slave" or "stub", the files needing to
689023771c563d8660e45d439a207e06e96de28fMark Andrews be cleaned up will be reported in the output
689023771c563d8660e45d439a207e06e96de28fMark Andrews of the <span><strong class="command">rndc delzone</strong></span> command.)
689023771c563d8660e45d439a207e06e96de28fMark Andrews If the zone was originally added via
689023771c563d8660e45d439a207e06e96de28fMark Andrews <span><strong class="command">rndc addzone</strong></span>, then it will be
a45a6ea2b03448751d7c44931e8ac7666e7cc2ceMark Andrews removed permanently. However, if it was originally
689023771c563d8660e45d439a207e06e96de28fMark Andrews configured in <code class="filename">named.conf</code>, then
689023771c563d8660e45d439a207e06e96de28fMark Andrews that original configuration is still in place; when
689023771c563d8660e45d439a207e06e96de28fMark Andrews the server is restarted or reconfigured, the zone will
689023771c563d8660e45d439a207e06e96de28fMark Andrews come back. To remove it permanently, it must also be
689023771c563d8660e45d439a207e06e96de28fMark Andrews removed from <code class="filename">named.conf</code>
689023771c563d8660e45d439a207e06e96de28fMark Andrews<dt><span class="term"><strong class="userinput"><code>showzone <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] </code></strong></span></dt>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Print the configuration of a running zone.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein<dt><span class="term"><strong class="userinput"><code>signing [<span class="optional">( -list | -clear <em class="replaceable"><code>keyid/algorithm</code></em> | -clear <code class="literal">all</code> | -nsec3param ( <em class="replaceable"><code>parameters</code></em> | <code class="literal">none</code> ) | -serial <em class="replaceable"><code>value</code></em> ) </span>] <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] </code></strong></span></dt>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein List, edit, or remove the DNSSEC signing state records
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein for the specified zone. The status of ongoing DNSSEC
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein operations (such as signing or generating
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein NSEC3 chains) is stored in the zone in the form
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein of DNS resource records of type
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <span><strong class="command">sig-signing-type</strong></span>.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <span><strong class="command">rndc signing -list</strong></span> converts
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein these records into a human-readable form,
6043e41fcf5dc91aa8a981c966512d73bdec31c1Mark Andrews indicating which keys are currently signing
6043e41fcf5dc91aa8a981c966512d73bdec31c1Mark Andrews or have finished signing the zone, and which NSEC3
6043e41fcf5dc91aa8a981c966512d73bdec31c1Mark Andrews chains are being created or removed.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <span><strong class="command">rndc signing -clear</strong></span> can remove
561a29af8c54a216e7d30b5b4f6e0d21661654ecMark Andrews a single key (specified in the same format that
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <span><strong class="command">rndc signing -list</strong></span> uses to
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein display it), or all keys. In either case, only
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein completed keys are removed; any record indicating
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein that a key has not yet finished signing the zone
689023771c563d8660e45d439a207e06e96de28fMark Andrews will be retained.
689023771c563d8660e45d439a207e06e96de28fMark Andrews <span><strong class="command">rndc signing -nsec3param</strong></span> sets
<span><strong class="command">rndc signing -nsec3param 1 0 10 FFFF <em class="replaceable"><code>zone</code></em></strong></span>.