rndc.html revision 9d557856c2a19ec95ee73245f60a92f8675cf5ba
297N/A<!--
297N/A - Copyright (C) 2004, 2005, 2007, 2013-2015 Internet Systems Consortium, Inc. ("ISC")
297N/A - Copyright (C) 2000, 2001 Internet Software Consortium.
297N/A -
297N/A - Permission to use, copy, modify, and/or distribute this software for any
297N/A - purpose with or without fee is hereby granted, provided that the above
297N/A - copyright notice and this permission notice appear in all copies.
297N/A -
297N/A - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
297N/A - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
297N/A - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
297N/A - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
297N/A - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
297N/A - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
297N/A - PERFORMANCE OF THIS SOFTWARE.
297N/A-->
297N/A<html>
297N/A<head>
297N/A<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
297N/A<title>rndc</title>
297N/A<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
297N/A</head>
297N/A<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
297N/A<a name="man.rndc"></a><div class="titlepage"></div>
297N/A<div class="refnamediv">
297N/A<h2>Name</h2>
297N/A<p><span class="application">rndc</span> &#8212; name server control utility</p>
297N/A</div>
297N/A<div class="refsynopsisdiv">
297N/A<h2>Synopsis</h2>
297N/A<div class="cmdsynopsis"><p><code class="command">rndc</code> [<code class="option">-b <em class="replaceable"><code>source-address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key-file</code></em></code>] [<code class="option">-s <em class="replaceable"><code>server</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-q</code>] [<code class="option">-r</code>] [<code class="option">-V</code>] [<code class="option">-y <em class="replaceable"><code>key_id</code></em></code>] {command}</p></div>
297N/A</div>
297N/A<div class="refsection">
297N/A<a name="id-1.7"></a><h2>DESCRIPTION</h2>
297N/A<p><span class="command"><strong>rndc</strong></span>
297N/A controls the operation of a name
297N/A server. It supersedes the <span class="command"><strong>ndc</strong></span> utility
297N/A that was provided in old BIND releases. If
297N/A <span class="command"><strong>rndc</strong></span> is invoked with no command line
297N/A options or arguments, it prints a short summary of the
297N/A supported commands and the available options and their
297N/A arguments.
297N/A </p>
297N/A<p><span class="command"><strong>rndc</strong></span>
297N/A communicates with the name server over a TCP connection, sending
297N/A commands authenticated with digital signatures. In the current
297N/A versions of
297N/A <span class="command"><strong>rndc</strong></span> and <span class="command"><strong>named</strong></span>,
297N/A the only supported authentication algorithms are HMAC-MD5
297N/A (for compatibility), HMAC-SHA1, HMAC-SHA224, HMAC-SHA256
297N/A (default), HMAC-SHA384 and HMAC-SHA512.
297N/A They use a shared secret on each end of the connection.
297N/A This provides TSIG-style authentication for the command
297N/A request and the name server's response. All commands sent
297N/A over the channel must be signed by a key_id known to the
297N/A server.
297N/A </p>
297N/A<p><span class="command"><strong>rndc</strong></span>
297N/A reads a configuration file to
297N/A determine how to contact the name server and decide what
297N/A algorithm and key it should use.
297N/A </p>
297N/A</div>
297N/A<div class="refsection">
297N/A<a name="id-1.8"></a><h2>OPTIONS</h2>
297N/A<div class="variablelist"><dl class="variablelist">
297N/A<dt><span class="term">-b <em class="replaceable"><code>source-address</code></em></span></dt>
297N/A<dd><p>
297N/A Use <em class="replaceable"><code>source-address</code></em>
297N/A as the source address for the connection to the server.
297N/A Multiple instances are permitted to allow setting of both
297N/A the IPv4 and IPv6 source addresses.
297N/A </p></dd>
297N/A<dt><span class="term">-c <em class="replaceable"><code>config-file</code></em></span></dt>
297N/A<dd><p>
297N/A Use <em class="replaceable"><code>config-file</code></em>
297N/A as the configuration file instead of the default,
297N/A <code class="filename">/etc/rndc.conf</code>.
297N/A </p></dd>
297N/A<dt><span class="term">-k <em class="replaceable"><code>key-file</code></em></span></dt>
297N/A<dd><p>
297N/A Use <em class="replaceable"><code>key-file</code></em>
297N/A as the key file instead of the default,
297N/A <code class="filename">/etc/rndc.key</code>. The key in
297N/A <code class="filename">/etc/rndc.key</code> will be used to
297N/A authenticate
297N/A commands sent to the server if the <em class="replaceable"><code>config-file</code></em>
297N/A does not exist.
297N/A </p></dd>
297N/A<dt><span class="term">-s <em class="replaceable"><code>server</code></em></span></dt>
297N/A<dd><p><em class="replaceable"><code>server</code></em> is
297N/A the name or address of the server which matches a
297N/A server statement in the configuration file for
297N/A <span class="command"><strong>rndc</strong></span>. If no server is supplied on the
297N/A command line, the host named by the default-server clause
297N/A in the options statement of the <span class="command"><strong>rndc</strong></span>
297N/A configuration file will be used.
297N/A </p></dd>
297N/A<dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
297N/A<dd><p>
297N/A Send commands to TCP port
297N/A <em class="replaceable"><code>port</code></em>
297N/A instead
297N/A of BIND 9's default control channel port, 953.
297N/A </p></dd>
297N/A<dt><span class="term">-q</span></dt>
297N/A<dd><p>
297N/A Quiet mode: Message text returned by the server
297N/A will not be printed except when there is an error.
297N/A </p></dd>
297N/A<dt><span class="term">-r</span></dt>
297N/A<dd><p>
297N/A Instructs <span class="command"><strong>rndc</strong></span> to print the result code
297N/A returned by <span class="command"><strong>named</strong></span> after executing the
297N/A requested command (e.g., ISC_R_SUCCESS, ISC_R_FAILURE, etc).
297N/A </p></dd>
297N/A<dt><span class="term">-V</span></dt>
297N/A<dd><p>
297N/A Enable verbose logging.
297N/A </p></dd>
297N/A<dt><span class="term">-y <em class="replaceable"><code>key_id</code></em></span></dt>
297N/A<dd><p>
297N/A Use the key <em class="replaceable"><code>key_id</code></em>
297N/A from the configuration file.
297N/A <em class="replaceable"><code>key_id</code></em>
297N/A must be
297N/A known by <span class="command"><strong>named</strong></span> with the same algorithm and secret string
297N/A in order for control message validation to succeed.
297N/A If no <em class="replaceable"><code>key_id</code></em>
297N/A is specified, <span class="command"><strong>rndc</strong></span> will first look
297N/A for a key clause in the server statement of the server
297N/A being used, or if no server statement is present for that
297N/A host, then the default-key clause of the options statement.
297N/A Note that the configuration file contains shared secrets
297N/A which are used to send authenticated control commands
297N/A to name servers. It should therefore not have general read
297N/A or write access.
297N/A </p></dd>
297N/A</dl></div>
297N/A</div>
297N/A<div class="refsection">
297N/A<a name="id-1.9"></a><h2>COMMANDS</h2>
297N/A<p>
297N/A A list of commands supported by <span class="command"><strong>rndc</strong></span> can
297N/A be seen by running <span class="command"><strong>rndc</strong></span> without arguments.
297N/A </p>
297N/A<p>
297N/A Currently supported commands are:
297N/A </p>
297N/A<div class="variablelist"><dl class="variablelist">
297N/A<dt><span class="term"><strong class="userinput"><code>addzone <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] <em class="replaceable"><code>configuration</code></em> </code></strong></span></dt>
297N/A<dd>
297N/A<p>
297N/A Add a zone while the server is running. This
297N/A command requires the
297N/A <span class="command"><strong>allow-new-zones</strong></span> option to be set
297N/A to <strong class="userinput"><code>yes</code></strong>. The
297N/A <em class="replaceable"><code>configuration</code></em> string
297N/A specified on the command line is the zone
297N/A configuration text that would ordinarily be
297N/A placed in <code class="filename">named.conf</code>.
297N/A </p>
297N/A<p>
297N/A The configuration is saved in a file called
297N/A <code class="filename"><em class="replaceable"><code>name</code></em>.nzf</code>,
297N/A where <em class="replaceable"><code>name</code></em> is the
297N/A name of the view, or if it contains characters
297N/A that are incompatible with use as a file name, a
297N/A cryptographic hash generated from the name
297N/A of the view.
297N/A When <span class="command"><strong>named</strong></span> is
297N/A restarted, the file will be loaded into the view
297N/A configuration, so that zones that were added
297N/A can persist after a restart.
297N/A </p>
297N/A<p>
297N/A This sample <span class="command"><strong>addzone</strong></span> command
297N/A would add the zone <code class="literal">example.com</code>
297N/A to the default view:
297N/A </p>
297N/A<p>
297N/A<code class="prompt">$ </code><strong class="userinput"><code>rndc addzone example.com '{ type master; file "example.com.db"; };'</code></strong>
297N/A </p>
297N/A<p>
297N/A (Note the brackets and semi-colon around the zone
297N/A configuration text.)
297N/A </p>
297N/A<p>
297N/A See also <span class="command"><strong>rndc delzone</strong></span> and <span class="command"><strong>rndc modzone</strong></span>.
297N/A </p>
297N/A</dd>
297N/A<dt><span class="term"><strong class="userinput"><code>delzone [<span class="optional">-clean</span>] <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] </code></strong></span></dt>
297N/A<dd>
297N/A<p>
297N/A Delete a zone while the server is running.
297N/A </p>
297N/A<p>
297N/A If the <code class="option">-clean</code> argument is specified,
297N/A the zone's master file (and journal file, if any)
297N/A will be deleted along with the zone. Without the
297N/A <code class="option">-clean</code> option, zone files must
297N/A be cleaned up by hand. (If the zone is of
297N/A type "slave" or "stub", the files needing to
297N/A be cleaned up will be reported in the output
297N/A of the <span class="command"><strong>rndc delzone</strong></span> command.)
297N/A </p>
297N/A<p>
297N/A If the zone was originally added via
297N/A <span class="command"><strong>rndc addzone</strong></span>, then it will be
297N/A removed permanently. However, if it was originally
297N/A configured in <code class="filename">named.conf</code>, then
297N/A that original configuration is still in place; when
297N/A the server is restarted or reconfigured, the zone will
297N/A come back. To remove it permanently, it must also be
297N/A removed from <code class="filename">named.conf</code>
297N/A </p>
297N/A<p>
297N/A See also <span class="command"><strong>rndc addzone</strong></span> and <span class="command"><strong>rndc modzone</strong></span>.
297N/A </p>
297N/A</dd>
297N/A<dt><span class="term"><strong class="userinput"><code>dumpdb [<span class="optional">-all|-cache|-zone|-adb|-bad|-fail</span>] [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
297N/A<dd><p>
297N/A Dump the server's caches (default) and/or zones to
297N/A the
297N/A dump file for the specified views. If no view is
297N/A specified, all
297N/A views are dumped.
297N/A (See the <span class="command"><strong>dump-file</strong></span> option in
297N/A the BIND 9 Administrator Reference Manual.)
297N/A </p></dd>
297N/A<dt><span class="term"><strong class="userinput"><code>flush</code></strong></span></dt>
297N/A<dd><p>
297N/A Flushes the server's cache.
297N/A </p></dd>
297N/A<dt><span class="term"><strong class="userinput"><code>flushname</code></strong> <em class="replaceable"><code>name</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>] </span></dt>
297N/A<dd><p>
297N/A Flushes the given name from the view's DNS cache
297N/A and, if applicable, from the view's nameserver address
297N/A database, bad server cache and SERVFAIL cache.
297N/A </p></dd>
297N/A<dt><span class="term"><strong class="userinput"><code>flushtree</code></strong> <em class="replaceable"><code>name</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>] </span></dt>
297N/A<dd><p>
297N/A Flushes the given name, and all of its subdomains,
297N/A from the view's DNS cache, address database,
297N/A bad server cache, and SERVFAIL cache.
297N/A </p></dd>
297N/A<dt><span class="term"><strong class="userinput"><code>freeze [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
297N/A<dd>
297N/A<p>
297N/A Suspend updates to a dynamic zone. If no zone is
297N/A specified, then all zones are suspended. This allows
297N/A manual edits to be made to a zone normally updated by
297N/A dynamic update. It also causes changes in the
297N/A journal file to be synced into the master file.
297N/A All dynamic update attempts will be refused while
297N/A the zone is frozen.
297N/A </p>
297N/A<p>
297N/A See also <span class="command"><strong>rndc thaw</strong></span>.
297N/A </p>
297N/A</dd>
297N/A<dt><span class="term"><strong class="userinput"><code>halt [<span class="optional">-p</span>]</code></strong></span></dt>
297N/A<dd>
297N/A<p>
297N/A Stop the server immediately. Recent changes
297N/A made through dynamic update or IXFR are not saved to
297N/A the master files, but will be rolled forward from the
297N/A journal files when the server is restarted.
297N/A If <code class="option">-p</code> is specified <span class="command"><strong>named</strong></span>'s process id is returned.
297N/A This allows an external process to determine when <span class="command"><strong>named</strong></span>
297N/A had completed halting.
297N/A </p>
297N/A<p>
297N/A See also <span class="command"><strong>rndc stop</strong></span>.
297N/A </p>
297N/A</dd>
297N/A<dt><span class="term"><strong class="userinput"><code>loadkeys <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
297N/A<dd>
297N/A<p>
297N/A Fetch all DNSSEC keys for the given zone
297N/A from the key directory. If they are within
297N/A their publication period, merge them into the
297N/A zone's DNSKEY RRset. Unlike <span class="command"><strong>rndc
297N/A sign</strong></span>, however, the zone is not
297N/A immediately re-signed by the new keys, but is
297N/A allowed to incrementally re-sign over time.
297N/A </p>
297N/A<p>
297N/A This command requires that the
297N/A <span class="command"><strong>auto-dnssec</strong></span> zone option
297N/A be set to <code class="literal">maintain</code>,
297N/A and also requires the zone to be configured to
297N/A allow dynamic DNS.
297N/A (See "Dynamic Update Policies" in the Administrator
297N/A Reference Manual for more details.)
297N/A </p>
297N/A</dd>
297N/A<dt><span class="term"><strong class="userinput"><code>managed-keys <em class="replaceable"><code>(status | refresh | sync)</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
297N/A<dd><p>
297N/A When run with the "status" keyword, print the current
297N/A status of the managed-keys database for the specified
297N/A view, or for all views if none is specified. When run
297N/A with the "refresh" keyword, force an immediate refresh
297N/A of all the managed-keys in the specified view, or all
297N/A views. When run with the "sync" keyword, force an
297N/A immediate dump of the managed-keys database to disk (in
297N/A the file <code class="filename">managed-keys.bind</code> or
297N/A (<code class="filename"><em class="replaceable"><code>viewname</code></em>.mkeys</code>).
297N/A </p></dd>
297N/A<dt><span class="term"><strong class="userinput"><code>modzone <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] <em class="replaceable"><code>configuration</code></em> </code></strong></span></dt>
297N/A<dd>
297N/A<p>
297N/A Modify the configuration of a zone while the server
297N/A is running. This command requires the
297N/A <span class="command"><strong>allow-new-zones</strong></span> option to be
297N/A set to <strong class="userinput"><code>yes</code></strong>. As with
297N/A <span class="command"><strong>addzone</strong></span>, the
297N/A <em class="replaceable"><code>configuration</code></em> string
297N/A specified on the command line is the zone
297N/A configuration text that would ordinarily be
297N/A placed in <code class="filename">named.conf</code>.
297N/A </p>
297N/A<p>
297N/A If the zone was originally added via
297N/A <span class="command"><strong>rndc addzone</strong></span>, the configuration
297N/A changes will be recorded permanently and will still be
297N/A in effect after the server is restarted or reconfigured.
297N/A However, if it was originally configured in
297N/A <code class="filename">named.conf</code>, then that original
297N/A configuration is still in place; when the server is
297N/A restarted or reconfigured, the zone will revert to
297N/A its original configuration. To make the changes
297N/A permanent, it must also be modified in
297N/A <code class="filename">named.conf</code>
297N/A </p>
297N/A<p>
297N/A See also <span class="command"><strong>rndc addzone</strong></span> and <span class="command"><strong>rndc delzone</strong></span>.
297N/A </p>
297N/A</dd>
297N/A<dt><span class="term"><strong class="userinput"><code>notify <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
297N/A<dd><p>
297N/A Resend NOTIFY messages for the zone.
297N/A </p></dd>
297N/A<dt><span class="term"><strong class="userinput"><code>notrace</code></strong></span></dt>
297N/A<dd>
297N/A<p>
297N/A Sets the server's debugging level to 0.
297N/A </p>
297N/A<p>
297N/A See also <span class="command"><strong>rndc trace</strong></span>.
297N/A </p>
297N/A</dd>
297N/A<dt><span class="term"><strong class="userinput"><code>nta
297N/A [<span class="optional">( -d | -f | -r | -l <em class="replaceable"><code>duration</code></em>)</span>]
297N/A <em class="replaceable"><code>domain</code></em>
297N/A [<span class="optional"><em class="replaceable"><code>view</code></em></span>]
297N/A </code></strong></span></dt>
297N/A<dd>
297N/A<p>
297N/A Sets a DNSSEC negative trust anchor (NTA)
297N/A for <code class="option">domain</code>, with a lifetime of
297N/A <code class="option">duration</code>. The default lifetime is
297N/A configured in <code class="filename">named.conf</code> via the
297N/A <code class="option">nta-lifetime</code> option, and defaults to
297N/A one hour. The lifetime cannot exceed one week.
297N/A </p>
297N/A<p>
297N/A A negative trust anchor selectively disables
297N/A DNSSEC validation for zones that are known to be
297N/A failing because of misconfiguration rather than
297N/A an attack. When data to be validated is
297N/A at or below an active NTA (and above any other
297N/A configured trust anchors), <span class="command"><strong>named</strong></span> will
297N/A abort the DNSSEC validation process and treat the data as
297N/A insecure rather than bogus. This continues until the
297N/A NTA's lifetime is elapsed.
297N/A </p>
297N/A<p>
297N/A NTAs persist across restarts of the <span class="command"><strong>named</strong></span> server.
297N/A The NTAs for a view are saved in a file called
297N/A <code class="filename"><em class="replaceable"><code>name</code></em>.nta</code>,
297N/A where <em class="replaceable"><code>name</code></em> is the
297N/A name of the view, or if it contains characters
297N/A that are incompatible with use as a file name, a
297N/A cryptographic hash generated from the name
297N/A of the view.
297N/A </p>
297N/A<p>
297N/A An existing NTA can be removed by using the
297N/A <code class="option">-remove</code> option.
297N/A </p>
297N/A<p>
297N/A An NTA's lifetime can be specified with the
297N/A <code class="option">-lifetime</code> option. TTL-style
297N/A suffixes can be used to specify the lifetime in
297N/A seconds, minutes, or hours. If the specified NTA
297N/A already exists, its lifetime will be updated to the
297N/A new value. Setting <code class="option">lifetime</code> to zero
297N/A is equivalent to <code class="option">-remove</code>.
297N/A </p>
297N/A<p>
297N/A If <code class="option">-dump</code> is used, any other arguments
297N/A are ignored, and a list of existing NTAs is printed
297N/A (note that this may include NTAs that are expired but
297N/A have not yet been cleaned up).
297N/A </p>
297N/A<p>
297N/A Normally, <span class="command"><strong>named</strong></span> will periodically
297N/A test to see whether data below an NTA can now be
297N/A validated (see the <code class="option">nta-recheck</code> option
297N/A in the Administrator Reference Manual for details).
297N/A If data can be validated, then the NTA is regarded as
297N/A no longer necessary, and will be allowed to expire
297N/A early. The <code class="option">-force</code> overrides this
297N/A behavior and forces an NTA to persist for its entire
297N/A lifetime, regardless of whether data could be
297N/A validated if the NTA were not present.
297N/A </p>
297N/A<p>
297N/A All of these options can be shortened, i.e., to
297N/A <code class="option">-l</code>, <code class="option">-r</code>, <code class="option">-d</code>,
297N/A and <code class="option">-f</code>.
297N/A </p>
297N/A</dd>
297N/A<dt><span class="term"><strong class="userinput"><code>querylog</code></strong> [<span class="optional">on|off</span>] </span></dt>
297N/A<dd>
297N/A<p>
297N/A Enable or disable query logging. (For backward
297N/A compatibility, this command can also be used without
297N/A an argument to toggle query logging on and off.)
297N/A </p>
297N/A<p>
297N/A Query logging can also be enabled
297N/A by explicitly directing the <span class="command"><strong>queries</strong></span>
297N/A <span class="command"><strong>category</strong></span> to a
297N/A <span class="command"><strong>channel</strong></span> in the
297N/A <span class="command"><strong>logging</strong></span> section of
297N/A <code class="filename">named.conf</code> or by specifying
297N/A <span class="command"><strong>querylog yes;</strong></span> in the
297N/A <span class="command"><strong>options</strong></span> section of
297N/A <code class="filename">named.conf</code>.
297N/A </p>
297N/A</dd>
297N/A<dt><span class="term"><strong class="userinput"><code>reconfig</code></strong></span></dt>
297N/A<dd><p>
297N/A Reload the configuration file and load new zones,
297N/A but do not reload existing zone files even if they
297N/A have changed.
297N/A This is faster than a full <span class="command"><strong>reload</strong></span> when there
297N/A is a large number of zones because it avoids the need
297N/A to examine the
297N/A modification times of the zones files.
297N/A </p></dd>
297N/A<dt><span class="term"><strong class="userinput"><code>recursing</code></strong></span></dt>
297N/A<dd><p>
297N/A Dump the list of queries <span class="command"><strong>named</strong></span> is currently
297N/A recursing on, and the list of domains to which iterative
297N/A queries are currently being sent. (The second list includes
297N/A the number of fetches currently active for the given domain,
297N/A and how many have been passed or dropped because of the
297N/A <code class="option">fetches-per-zone</code> option.)
297N/A </p></dd>
297N/A<dt><span class="term"><strong class="userinput"><code>refresh <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
297N/A<dd><p>
297N/A Schedule zone maintenance for the given zone.
297N/A </p></dd>
297N/A<dt><span class="term"><strong class="userinput"><code>reload</code></strong></span></dt>
297N/A<dd><p>
297N/A Reload configuration file and zones.
297N/A </p></dd>
297N/A<dt><span class="term"><strong class="userinput"><code>reload <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
297N/A<dd><p>
297N/A Reload the given zone.
297N/A </p></dd>
297N/A<dt><span class="term"><strong class="userinput"><code>retransfer <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
297N/A<dd>
297N/A<p>
297N/A Retransfer the given slave zone from the master server.
297N/A </p>
297N/A<p>
297N/A If the zone is configured to use
297N/A <span class="command"><strong>inline-signing</strong></span>, the signed
297N/A version of the zone is discarded; after the
297N/A retransfer of the unsigned version is complete, the
297N/A signed version will be regenerated with all new
297N/A signatures.
297N/A </p>
297N/A</dd>
297N/A<dt><span class="term"><strong class="userinput"><code>scan</code></strong></span></dt>
297N/A<dd><p>
297N/A Scan the list of available network interfaces
297N/A for changes, without performing a full
297N/A <span class="command"><strong>reconfig</strong></span> or waiting for the
297N/A <span class="command"><strong>interface-interval</strong></span> timer.
297N/A </p></dd>
297N/A<dt><span class="term"><strong class="userinput"><code>secroots [<span class="optional">-</span>] [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
297N/A<dd>
297N/A<p>
297N/A Dump the server's security roots and negative trust anchors
297N/A for the specified views. If no view is specified, all views
297N/A are dumped.
297N/A </p>
297N/A<p>
297N/A If the first argument is "-", then the output is
297N/A returned via the <span class="command"><strong>rndc</strong></span> response channel
297N/A and printed to the standard output.
297N/A Otherwise, it is written to the secroots dump file, which
297N/A defaults to <code class="filename">named.secroots</code>, but can be
297N/A overridden via the <code class="option">secroots-file</code> option in
297N/A <code class="filename">named.conf</code>.
297N/A </p>
297N/A<p>
297N/A See also <span class="command"><strong>rndc managed-keys</strong></span>.
297N/A </p>
297N/A</dd>
297N/A<dt><span class="term"><strong class="userinput"><code>showzone <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] </code></strong></span></dt>
297N/A<dd>
297N/A<p>
297N/A Print the configuration of a running zone.
297N/A </p>
297N/A<p>
297N/A See also <span class="command"><strong>rndc zonestatus</strong></span>.
297N/A </p>
297N/A</dd>
297N/A<dt><span class="term"><strong class="userinput"><code>sign <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
297N/A<dd>
297N/A<p>
297N/A Fetch all DNSSEC keys for the given zone
297N/A from the key directory (see the
297N/A <span class="command"><strong>key-directory</strong></span> option in
297N/A the BIND 9 Administrator Reference Manual). If they are within
297N/A their publication period, merge them into the
297N/A zone's DNSKEY RRset. If the DNSKEY RRset
297N/A is changed, then the zone is automatically
297N/A re-signed with the new key set.
297N/A </p>
297N/A<p>
297N/A This command requires that the
297N/A <span class="command"><strong>auto-dnssec</strong></span> zone option be set
297N/A to <code class="literal">allow</code> or
297N/A <code class="literal">maintain</code>,
297N/A and also requires the zone to be configured to
297N/A allow dynamic DNS.
297N/A (See "Dynamic Update Policies" in the Administrator
297N/A Reference Manual for more details.)
297N/A </p>
297N/A<p>
297N/A See also <span class="command"><strong>rndc loadkeys</strong></span>.
297N/A </p>
297N/A</dd>
297N/A<dt><span class="term"><strong class="userinput"><code>signing [<span class="optional">( -list | -clear <em class="replaceable"><code>keyid/algorithm</code></em> | -clear <code class="literal">all</code> | -nsec3param ( <em class="replaceable"><code>parameters</code></em> | <code class="literal">none</code> ) | -serial <em class="replaceable"><code>value</code></em> ) </span>] <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] </code></strong></span></dt>
297N/A<dd>
297N/A<p>
297N/A List, edit, or remove the DNSSEC signing state records
297N/A for the specified zone. The status of ongoing DNSSEC
297N/A operations (such as signing or generating
297N/A NSEC3 chains) is stored in the zone in the form
297N/A of DNS resource records of type
297N/A <span class="command"><strong>sig-signing-type</strong></span>.
297N/A <span class="command"><strong>rndc signing -list</strong></span> converts
297N/A these records into a human-readable form,
297N/A indicating which keys are currently signing
297N/A or have finished signing the zone, and which NSEC3
297N/A chains are being created or removed.
297N/A </p>
297N/A<p>
297N/A <span class="command"><strong>rndc signing -clear</strong></span> can remove
297N/A a single key (specified in the same format that
297N/A <span class="command"><strong>rndc signing -list</strong></span> uses to
297N/A display it), or all keys. In either case, only
297N/A completed keys are removed; any record indicating
297N/A that a key has not yet finished signing the zone
297N/A will be retained.
297N/A </p>
297N/A<p>
297N/A <span class="command"><strong>rndc signing -nsec3param</strong></span> sets
297N/A the NSEC3 parameters for a zone. This is the
297N/A only supported mechanism for using NSEC3 with
297N/A <span class="command"><strong>inline-signing</strong></span> zones.
297N/A Parameters are specified in the same format as
297N/A an NSEC3PARAM resource record: hash algorithm,
297N/A flags, iterations, and salt, in that order.
297N/A </p>
297N/A<p>
297N/A Currently, the only defined value for hash algorithm
297N/A is <code class="literal">1</code>, representing SHA-1.
297N/A The <code class="option">flags</code> may be set to
297N/A <code class="literal">0</code> or <code class="literal">1</code>,
297N/A depending on whether you wish to set the opt-out
297N/A bit in the NSEC3 chain. <code class="option">iterations</code>
297N/A defines the number of additional times to apply
297N/A the algorithm when generating an NSEC3 hash. The
297N/A <code class="option">salt</code> is a string of data expressed
297N/A in hexadecimal, a hyphen (`-') if no salt is
297N/A to be used, or the keyword <code class="literal">auto</code>,
297N/A which causes <span class="command"><strong>named</strong></span> to generate a
297N/A random 64-bit salt.
297N/A </p>
297N/A<p>
297N/A So, for example, to create an NSEC3 chain using
297N/A the SHA-1 hash algorithm, no opt-out flag,
297N/A 10 iterations, and a salt value of "FFFF", use:
297N/A <span class="command"><strong>rndc signing -nsec3param 1 0 10 FFFF <em class="replaceable"><code>zone</code></em></strong></span>.
297N/A To set the opt-out flag, 15 iterations, and no
297N/A salt, use:
297N/A <span class="command"><strong>rndc signing -nsec3param 1 1 15 - <em class="replaceable"><code>zone</code></em></strong></span>.
297N/A </p>
297N/A<p>
297N/A <span class="command"><strong>rndc signing -nsec3param none</strong></span>
297N/A removes an existing NSEC3 chain and replaces it
297N/A with NSEC.
297N/A </p>
297N/A<p>
297N/A <span class="command"><strong>rndc signing -serial value</strong></span> sets
297N/A the serial number of the zone to value. If the value
297N/A would cause the serial number to go backwards it will
297N/A be rejected. The primary use is to set the serial on
297N/A inline signed zones.
297N/A </p>
297N/A</dd>
297N/A<dt><span class="term"><strong class="userinput"><code>stats</code></strong></span></dt>
297N/A<dd><p>
297N/A Write server statistics to the statistics file.
297N/A (See the <span class="command"><strong>statistics-file</strong></span> option in
297N/A the BIND 9 Administrator Reference Manual.)
297N/A </p></dd>
297N/A<dt><span class="term"><strong class="userinput"><code>status</code></strong></span></dt>
297N/A<dd><p>
297N/A Display status of the server.
297N/A Note that the number of zones includes the internal <span class="command"><strong>bind/CH</strong></span> zone
297N/A and the default <span class="command"><strong>/IN</strong></span>
297N/A hint zone if there is not an
297N/A explicit root zone configured.
297N/A </p></dd>
297N/A<dt><span class="term"><strong class="userinput"><code>stop [<span class="optional">-p</span>]</code></strong></span></dt>
297N/A<dd>
297N/A<p>
297N/A Stop the server, making sure any recent changes
297N/A made through dynamic update or IXFR are first saved to
297N/A the master files of the updated zones.
297N/A If <code class="option">-p</code> is specified <span class="command"><strong>named</strong></span>'s process id is returned.
297N/A This allows an external process to determine when <span class="command"><strong>named</strong></span>
297N/A had completed stopping.
297N/A </p>
297N/A<p>See also <span class="command"><strong>rndc halt</strong></span>.</p>
297N/A</dd>
297N/A<dt><span class="term"><strong class="userinput"><code>sync [<span class="optional">-clean</span>] [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
297N/A<dd><p>
297N/A Sync changes in the journal file for a dynamic zone
297N/A to the master file. If the "-clean" option is
297N/A specified, the journal file is also removed. If
297N/A no zone is specified, then all zones are synced.
297N/A </p></dd>
297N/A<dt><span class="term"><strong class="userinput"><code>thaw [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
297N/A<dd>
297N/A<p>
297N/A Enable updates to a frozen dynamic zone. If no
297N/A zone is specified, then all frozen zones are
297N/A enabled. This causes the server to reload the zone
297N/A from disk, and re-enables dynamic updates after the
297N/A load has completed. After a zone is thawed,
297N/A dynamic updates will no longer be refused. If
297N/A the zone has changed and the
297N/A <span class="command"><strong>ixfr-from-differences</strong></span> option is
297N/A in use, then the journal file will be updated to
297N/A reflect changes in the zone. Otherwise, if the
297N/A zone has changed, any existing journal file will be
297N/A removed.
297N/A </p>
297N/A<p>See also <span class="command"><strong>rndc freeze</strong></span>.</p>
297N/A</dd>
297N/A<dt><span class="term"><strong class="userinput"><code>trace</code></strong></span></dt>
297N/A<dd><p>
297N/A Increment the servers debugging level by one.
297N/A </p></dd>
297N/A<dt><span class="term"><strong class="userinput"><code>trace <em class="replaceable"><code>level</code></em></code></strong></span></dt>
297N/A<dd>
297N/A<p>
297N/A Sets the server's debugging level to an explicit
297N/A value.
297N/A </p>
297N/A<p>
297N/A See also <span class="command"><strong>rndc notrace</strong></span>.
297N/A </p>
297N/A</dd>
297N/A<dt><span class="term"><strong class="userinput"><code>tsig-delete</code></strong> <em class="replaceable"><code>keyname</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span></dt>
297N/A<dd><p>
297N/A Delete a given TKEY-negotiated key from the server.
297N/A (This does not apply to statically configured TSIG
297N/A keys.)
297N/A </p></dd>
297N/A<dt><span class="term"><strong class="userinput"><code>tsig-list</code></strong></span></dt>
297N/A<dd><p>
297N/A List the names of all TSIG keys currently configured
297N/A for use by <span class="command"><strong>named</strong></span> in each view. The
297N/A list both statically configured keys and dynamic
297N/A TKEY-negotiated keys.
297N/A </p></dd>
297N/A<dt><span class="term"><strong class="userinput"><code>validation ( on | off | check ) [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>] </code></strong></span></dt>
297N/A<dd><p>
297N/A Enable, disable, or check the current status of
297N/A DNSSEC validation.
297N/A Note <span class="command"><strong>dnssec-enable</strong></span> also needs to be
297N/A set to <strong class="userinput"><code>yes</code></strong> or
297N/A <strong class="userinput"><code>auto</code></strong> to be effective.
297N/A It defaults to enabled.
297N/A </p></dd>
297N/A<dt><span class="term"><strong class="userinput"><code>zonestatus <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
297N/A<dd>
297N/A<p>
297N/A Displays the current status of the given zone,
297N/A including the master file name and any include
297N/A files from which it was loaded, when it was most
297N/A recently loaded, the current serial number, the
297N/A number of nodes, whether the zone supports
297N/A dynamic updates, whether the zone is DNSSEC
297N/A signed, whether it uses automatic DNSSEC key
297N/A management or inline signing, and the scheduled
297N/A refresh or expiry times for the zone.
297N/A </p>
297N/A<p>
297N/A See also <span class="command"><strong>rndc showzone</strong></span>.
297N/A </p>
297N/A</dd>
297N/A</dl></div>
297N/A</div>
297N/A<div class="refsection">
297N/A<a name="id-1.10"></a><h2>LIMITATIONS</h2>
297N/A<p>
297N/A There is currently no way to provide the shared secret for a
297N/A <code class="option">key_id</code> without using the configuration file.
297N/A </p>
297N/A<p>
297N/A Several error messages could be clearer.
297N/A </p>
297N/A</div>
297N/A<div class="refsection">
297N/A<a name="id-1.11"></a><h2>SEE ALSO</h2>
297N/A<p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
297N/A <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
297N/A <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
297N/A <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
297N/A <span class="citerefentry"><span class="refentrytitle">ndc</span>(8)</span>,
297N/A <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
297N/A </p>
297N/A</div>
297N/A</div></body>
297N/A</html>
297N/A