man.delv.html revision 5fa6a064b8301e4f274bd132fd577def59e4fb4c
355b4669e025ff377602b6fc7caaf30dbc218371jacobs - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
355b4669e025ff377602b6fc7caaf30dbc218371jacobs - Copyright (C) 2000-2003 Internet Software Consortium.
355b4669e025ff377602b6fc7caaf30dbc218371jacobs - Permission to use, copy, modify, and/or distribute this software for any
355b4669e025ff377602b6fc7caaf30dbc218371jacobs - purpose with or without fee is hereby granted, provided that the above
355b4669e025ff377602b6fc7caaf30dbc218371jacobs - copyright notice and this permission notice appear in all copies.
355b4669e025ff377602b6fc7caaf30dbc218371jacobs - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
355b4669e025ff377602b6fc7caaf30dbc218371jacobs - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
355b4669e025ff377602b6fc7caaf30dbc218371jacobs - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
355b4669e025ff377602b6fc7caaf30dbc218371jacobs - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
355b4669e025ff377602b6fc7caaf30dbc218371jacobs - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
355b4669e025ff377602b6fc7caaf30dbc218371jacobs - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
355b4669e025ff377602b6fc7caaf30dbc218371jacobs - PERFORMANCE OF THIS SOFTWARE.
355b4669e025ff377602b6fc7caaf30dbc218371jacobs<!-- $Id$ -->
355b4669e025ff377602b6fc7caaf30dbc218371jacobs<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
355b4669e025ff377602b6fc7caaf30dbc218371jacobs<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
355b4669e025ff377602b6fc7caaf30dbc218371jacobs<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
355b4669e025ff377602b6fc7caaf30dbc218371jacobs<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
bfed486ad8de8b8ebc6345a8e10accae08bf2f45Ali Bahrami<link rel="prev" href="man.host.html" title="host">
bfed486ad8de8b8ebc6345a8e10accae08bf2f45Ali Bahrami<link rel="next" href="man.dnssec-checkds.html" title="dnssec-checkds">
bfed486ad8de8b8ebc6345a8e10accae08bf2f45Ali Bahrami<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
bfed486ad8de8b8ebc6345a8e10accae08bf2f45Ali Bahrami<tr><th colspan="3" align="center">delv</th></tr>
bfed486ad8de8b8ebc6345a8e10accae08bf2f45Ali Bahrami<a accesskey="p" href="man.host.html">Prev</a>�</td>
bfed486ad8de8b8ebc6345a8e10accae08bf2f45Ali Bahrami<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-checkds.html">Next</a>
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami<p>delv — DNS lookup and validation utility</p>
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami<div class="cmdsynopsis"><p><code class="command">delv</code> [@server] [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-a <em class="replaceable"><code>anchor-file</code></em></code>] [<code class="option">-b <em class="replaceable"><code>address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>level</code></em></code>] [<code class="option">-i</code>] [<code class="option">-m</code>] [<code class="option">-p <em class="replaceable"><code>port#</code></em></code>] [<code class="option">-q <em class="replaceable"><code>name</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-x <em class="replaceable"><code>addr</code></em></code>] [name] [type] [class] [queryopt...]</p></div>
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami<div class="cmdsynopsis"><p><code class="command">delv</code> [<code class="option">-h</code>]</p></div>
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami<div class="cmdsynopsis"><p><code class="command">delv</code> [<code class="option">-v</code>]</p></div>
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami<div class="cmdsynopsis"><p><code class="command">delv</code> [queryopt...] [query...]</p></div>
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami<p><span><strong class="command">delv</strong></span>
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami (Domain Entity Lookup & Validation) is a tool for sending
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami DNS queries and validating the results, using the the same internal
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami resolver and validator logic as <span><strong class="command">named</strong></span>.
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami <span><strong class="command">delv</strong></span> will send to a specified name server all
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami queries needed to fetch and validate the requested data; this
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami includes the original requested query, subsequent queries to follow
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami CNAME or DNAME chains, and queries for DNSKEY, DS and DLV records
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami to establish a chain of trust for DNSSEC validation.
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami It does not perform iterative resolution, but simulates the
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami behavior of a name server configured for DNSSEC validating and
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami By default, responses are validated using built-in DNSSEC trust
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami anchors for the root zone (".") and for the ISC DNSSEC lookaside
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami validation zone ("dlv.isc.org"). Records returned by
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami <span><strong class="command">delv</strong></span> are either fully validated or
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami were not signed. If validation fails, an explanation of
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami the failure is included in the output; the validation process
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami can be traced in detail. Because <span><strong class="command">delv</strong></span> does
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami not rely on an external server to carry out validation, it can
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami be used to check the validity of DNS responses in environments
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami where local name servers may not be trustworthy.
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami Unless it is told to query a specific name server,
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami <span><strong class="command">delv</strong></span> will try each of the servers listed in
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami <code class="filename">/etc/resolv.conf</code>. If no usable server
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami addresses are found, <span><strong class="command">delv</strong></span> will send
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami queries to the localhost addresses (127.0.0.1 for IPv4, ::1
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami When no command line arguments or options are given,
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami <span><strong class="command">delv</strong></span> will perform an NS query for "."
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami (the root zone).
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami A typical invocation of <span><strong class="command">delv</strong></span> looks like:
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami<pre class="programlisting"> delv @server name type </pre>
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami<dt><span class="term"><code class="constant">server</code></span></dt>
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami is the name or IP address of the name server to query. This
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami can be an IPv4 address in dotted-decimal notation or an IPv6
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami address in colon-delimited notation. When the supplied
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami <em class="parameter"><code>server</code></em> argument is a hostname,
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami <span><strong class="command">delv</strong></span> resolves that name before
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami querying that name server (note, however, that this
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami initial lookup is <span class="emphasis"><em>not</em></span> validated
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami If no <em class="parameter"><code>server</code></em> argument is
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami provided, <span><strong class="command">delv</strong></span> consults
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami <code class="filename">/etc/resolv.conf</code>; if an
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami address is found there, it queries the name server at
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami that address. If either of the <code class="option">-4</code> or
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami <code class="option">-6</code> options are in use, then
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami only addresses for the corresponding transport
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami will be tried. If no usable addresses are found,
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami <span><strong class="command">delv</strong></span> will send queries to
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami the localhost addresses (127.0.0.1 for IPv4,
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami ::1 for IPv6).
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami<dt><span class="term"><code class="constant">name</code></span></dt>
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami is the domain name to be looked up.
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami<dt><span class="term"><code class="constant">type</code></span></dt>
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami indicates what type of query is required —
355b4669e025ff377602b6fc7caaf30dbc218371jacobs ANY, A, MX, etc.
355b4669e025ff377602b6fc7caaf30dbc218371jacobs <em class="parameter"><code>type</code></em> can be any valid query
355b4669e025ff377602b6fc7caaf30dbc218371jacobs type. If no
355b4669e025ff377602b6fc7caaf30dbc218371jacobs <em class="parameter"><code>type</code></em> argument is supplied,
355b4669e025ff377602b6fc7caaf30dbc218371jacobs <span><strong class="command">delv</strong></span> will perform a lookup for an
355b4669e025ff377602b6fc7caaf30dbc218371jacobs<dt><span class="term">-a <em class="replaceable"><code>anchor-file</code></em></span></dt>
355b4669e025ff377602b6fc7caaf30dbc218371jacobs Specifies a file from which to read DNSSEC trust anchors.
355b4669e025ff377602b6fc7caaf30dbc218371jacobs The default is <code class="filename">/etc/bind.keys</code>, which
355b4669e025ff377602b6fc7caaf30dbc218371jacobs is included with <acronym class="acronym">BIND</acronym> 9 and contains
355b4669e025ff377602b6fc7caaf30dbc218371jacobs trust anchors for the root zone (".") and for the ISC
355b4669e025ff377602b6fc7caaf30dbc218371jacobs DNSSEC lookaside validation zone ("dlv.isc.org").
355b4669e025ff377602b6fc7caaf30dbc218371jacobs Keys that do not match the root or DLV trust-anchor
355b4669e025ff377602b6fc7caaf30dbc218371jacobs names are ignored; these key names can be overridden
355b4669e025ff377602b6fc7caaf30dbc218371jacobs Note: When reading the trust anchor file,
355b4669e025ff377602b6fc7caaf30dbc218371jacobs <span><strong class="command">delv</strong></span> treats <code class="option">managed-keys</code>
355b4669e025ff377602b6fc7caaf30dbc218371jacobs statements and <code class="option">trusted-keys</code> statements
355b4669e025ff377602b6fc7caaf30dbc218371jacobs identically. That is, for a managed key, it is the
355b4669e025ff377602b6fc7caaf30dbc218371jacobs <span class="emphasis"><em>initial</em></span> key that is trusted; RFC 5011
355b4669e025ff377602b6fc7caaf30dbc218371jacobs key management is not supported. <span><strong class="command">delv</strong></span>
355b4669e025ff377602b6fc7caaf30dbc218371jacobs will not consult the managed-keys database maintained by
355b4669e025ff377602b6fc7caaf30dbc218371jacobs <span><strong class="command">named</strong></span>. This means that if either of the
355b4669e025ff377602b6fc7caaf30dbc218371jacobs keys in <code class="filename">/etc/bind.keys</code> is revoked
355b4669e025ff377602b6fc7caaf30dbc218371jacobs and rolled over, it will be necessary to update
355b4669e025ff377602b6fc7caaf30dbc218371jacobs <code class="filename">/etc/bind.keys</code> to use DNSSEC
355b4669e025ff377602b6fc7caaf30dbc218371jacobs validation in <span><strong class="command">delv</strong></span>.
355b4669e025ff377602b6fc7caaf30dbc218371jacobs<dt><span class="term">-b <em class="replaceable"><code>address</code></em></span></dt>
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami Sets the source IP address of the query to
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami <em class="parameter"><code>address</code></em>. This must be a valid address
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami on one of the host's network interfaces or "0.0.0.0" or "::".
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami An optional source port may be specified by appending
355b4669e025ff377602b6fc7caaf30dbc218371jacobs "#<port>"
355b4669e025ff377602b6fc7caaf30dbc218371jacobs<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami Sets the query class for the requested data. Currently,
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami only class "IN" is supported in <span><strong class="command">delv</strong></span>
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami and any other value is ignored.
355b4669e025ff377602b6fc7caaf30dbc218371jacobs<dt><span class="term">-d <em class="replaceable"><code>level</code></em></span></dt>
355b4669e025ff377602b6fc7caaf30dbc218371jacobs Set the systemwide debug level to <code class="option">level</code>.
355b4669e025ff377602b6fc7caaf30dbc218371jacobs The allowed range is from 0 to 99.
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami The default is 0 (no debugging).
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami Debugging traces from <span><strong class="command">delv</strong></span> become
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami more verbose as the debug level increases.
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami See the <code class="option">+mtrace</code>, <code class="option">+rtrace</code>,
355b4669e025ff377602b6fc7caaf30dbc218371jacobs and <code class="option">+vtrace</code> options below for additional
355b4669e025ff377602b6fc7caaf30dbc218371jacobs debugging details.
355b4669e025ff377602b6fc7caaf30dbc218371jacobs Display the <span><strong class="command">delv</strong></span> help usage output and exit.
355b4669e025ff377602b6fc7caaf30dbc218371jacobs Insecure mode. This disables internal DNSSEC validation.
355b4669e025ff377602b6fc7caaf30dbc218371jacobs (Note, however, this does not set the CD bit on upstream
355b4669e025ff377602b6fc7caaf30dbc218371jacobs queries. If the server being queried is performing DNSSEC
355b4669e025ff377602b6fc7caaf30dbc218371jacobs validation, then it will not return invalid data; this
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami can cause <span><strong class="command">delv</strong></span> to time out. When it
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami is necessary to examine invalid data to debug a DNSSEC
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami problem, use <span><strong class="command">dig +cd</strong></span>.)
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami Enables memory usage debugging.
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami<dt><span class="term">-p <em class="replaceable"><code>port#</code></em></span></dt>
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami Specifies a destination port to use for queries instead of
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami the standard DNS port number 53. This option would be used
355b4669e025ff377602b6fc7caaf30dbc218371jacobs with a name server that has been configured to listen
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami for queries on a non-standard port number.
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami<dt><span class="term">-q <em class="replaceable"><code>name</code></em></span></dt>
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami Sets the query name to <em class="parameter"><code>name</code></em>.
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami While the query name can be specified without using the
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami <code class="option">-q</code>, it is sometimes necessary to disambiguate
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami names from types or classes (for example, when looking up the
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami name "ns", which could be misinterpreted as the type NS,
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami or "ch", which could be misinterpreted as class CH).
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami Sets the query type to <em class="parameter"><code>type</code></em>, which
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami can be any valid query type supported in BIND 9 except
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami for zone transfer types AXFR and IXFR. As with
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami <code class="option">-q</code>, this is useful to distinguish
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami query name type or class when they are ambiguous.
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami it is sometimes necessary to disambiguate names from types.
0a44ef6d9afbfe052a7e975f55ea0d2954b62a82jacobs The default query type is "A", unless the <code class="option">-x</code>
355b4669e025ff377602b6fc7caaf30dbc218371jacobs option is supplied to indicate a reverse lookup, in which case
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami it is "PTR".
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami Print the <span><strong class="command">delv</strong></span> version and exit.
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami<dt><span class="term">-x <em class="replaceable"><code>addr</code></em></span></dt>
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami Performs a reverse lookup, mapping an addresses to
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami a name. <em class="parameter"><code>addr</code></em> is an IPv4 address in
cd3e933325e68e23516a196a8fea7f49b1e497c3Ali Bahrami dotted-decimal notation, or a colon-delimited IPv6 address.
355b4669e025ff377602b6fc7caaf30dbc218371jacobs When <code class="option">-x</code> is used, there is no need to provide
355b4669e025ff377602b6fc7caaf30dbc218371jacobs the <em class="parameter"><code>name</code></em> or <em class="parameter"><code>type</code></em>
355b4669e025ff377602b6fc7caaf30dbc218371jacobs arguments. <span><strong class="command">delv</strong></span> automatically performs a
355b4669e025ff377602b6fc7caaf30dbc218371jacobs lookup for a name like <code class="literal">11.12.13.10.in-addr.arpa</code>
using nibble format under the IP6.ARPA domain.
e.g. "[ key id = value ]".
a trust anchor of "dlv.isc.org", for which there is a