man.delv.html revision 90d087cf9c73028362c63eaa41c87acc76fb8ec3
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster - Copyright (C) 2000-2003 Internet Software Consortium.
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster - Permission to use, copy, modify, and/or distribute this software for any
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster - purpose with or without fee is hereby granted, provided that the above
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster - copyright notice and this permission notice appear in all copies.
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster - PERFORMANCE OF THIS SOFTWARE.
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster<!-- $Id$ -->
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster<link rel="prev" href="man.host.html" title="host">
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster<link rel="next" href="man.dnssec-checkds.html" title="dnssec-checkds">
f2bd66b4677bf27f7ea709e9bfb1ae87080ac5ebKohei Tamura<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster<table width="100%" summary="Navigation header">
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster<tr><th colspan="3" align="center">delv</th></tr>
1067e734d6cec73ee954f2e43c1bba0e09d267cfPhill Cunnington<a accesskey="p" href="man.host.html">Prev</a>�</td>
1067e734d6cec73ee954f2e43c1bba0e09d267cfPhill Cunnington<th width="60%" align="center">Manual pages</th>
1067e734d6cec73ee954f2e43c1bba0e09d267cfPhill Cunnington<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-checkds.html">Next</a>
1067e734d6cec73ee954f2e43c1bba0e09d267cfPhill Cunnington<a name="man.delv"></a><div class="titlepage"></div>
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster<p>delv — DNS lookup and validation utility</p>
1067e734d6cec73ee954f2e43c1bba0e09d267cfPhill Cunnington<div class="cmdsynopsis"><p><code class="command">delv</code> [@server] [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-a <em class="replaceable"><code>anchor-file</code></em></code>] [<code class="option">-b <em class="replaceable"><code>address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>level</code></em></code>] [<code class="option">-i</code>] [<code class="option">-m</code>] [<code class="option">-p <em class="replaceable"><code>port#</code></em></code>] [<code class="option">-q <em class="replaceable"><code>name</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-x <em class="replaceable"><code>addr</code></em></code>] [name] [type] [class] [queryopt...]</p></div>
36bbe86e1acac2b608a7a82a0670ab4bec3e9acdBernhard Thalmayr<div class="cmdsynopsis"><p><code class="command">delv</code> [<code class="option">-h</code>]</p></div>
1067e734d6cec73ee954f2e43c1bba0e09d267cfPhill Cunnington<div class="cmdsynopsis"><p><code class="command">delv</code> [<code class="option">-v</code>]</p></div>
1067e734d6cec73ee954f2e43c1bba0e09d267cfPhill Cunnington<div class="cmdsynopsis"><p><code class="command">delv</code> [queryopt...] [query...]</p></div>
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster<p><span><strong class="command">delv</strong></span>
1067e734d6cec73ee954f2e43c1bba0e09d267cfPhill Cunnington (Domain Entity Lookup & Validation) is a tool for sending
1067e734d6cec73ee954f2e43c1bba0e09d267cfPhill Cunnington DNS queries and validating the results, using the same internal
1067e734d6cec73ee954f2e43c1bba0e09d267cfPhill Cunnington resolver and validator logic as <span><strong class="command">named</strong></span>.
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster <span><strong class="command">delv</strong></span> will send to a specified name server all
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster queries needed to fetch and validate the requested data; this
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster includes the original requested query, subsequent queries to follow
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster CNAME or DNAME chains, and queries for DNSKEY, DS and DLV records
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster to establish a chain of trust for DNSSEC validation.
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster It does not perform iterative resolution, but simulates the
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster behavior of a name server configured for DNSSEC validating and
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major By default, responses are validated using built-in DNSSEC trust
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major anchors for the root zone (".") and for the ISC DNSSEC lookaside
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major validation zone ("dlv.isc.org"). Records returned by
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major <span><strong class="command">delv</strong></span> are either fully validated or
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major were not signed. If validation fails, an explanation of
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major the failure is included in the output; the validation process
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major can be traced in detail. Because <span><strong class="command">delv</strong></span> does
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major not rely on an external server to carry out validation, it can
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster be used to check the validity of DNS responses in environments
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster where local name servers may not be trustworthy.
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major Unless it is told to query a specific name server,
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major <span><strong class="command">delv</strong></span> will try each of the servers listed in
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster <code class="filename">/etc/resolv.conf</code>. If no usable server
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster addresses are found, <span><strong class="command">delv</strong></span> will send
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster queries to the localhost addresses (127.0.0.1 for IPv4, ::1
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major When no command line arguments or options are given,
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster <span><strong class="command">delv</strong></span> will perform an NS query for "."
1067e734d6cec73ee954f2e43c1bba0e09d267cfPhill Cunnington (the root zone).
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster A typical invocation of <span><strong class="command">delv</strong></span> looks like:
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster<pre class="programlisting"> delv @server name type </pre>
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster<dt><span class="term"><code class="constant">server</code></span></dt>
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster is the name or IP address of the name server to query. This
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster can be an IPv4 address in dotted-decimal notation or an IPv6
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster address in colon-delimited notation. When the supplied
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster <em class="parameter"><code>server</code></em> argument is a hostname,
1067e734d6cec73ee954f2e43c1bba0e09d267cfPhill Cunnington <span><strong class="command">delv</strong></span> resolves that name before
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster querying that name server (note, however, that this
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster initial lookup is <span class="emphasis"><em>not</em></span> validated
36bbe86e1acac2b608a7a82a0670ab4bec3e9acdBernhard Thalmayr If no <em class="parameter"><code>server</code></em> argument is
36bbe86e1acac2b608a7a82a0670ab4bec3e9acdBernhard Thalmayr provided, <span><strong class="command">delv</strong></span> consults
36bbe86e1acac2b608a7a82a0670ab4bec3e9acdBernhard Thalmayr <code class="filename">/etc/resolv.conf</code>; if an
36bbe86e1acac2b608a7a82a0670ab4bec3e9acdBernhard Thalmayr address is found there, it queries the name server at
36bbe86e1acac2b608a7a82a0670ab4bec3e9acdBernhard Thalmayr that address. If either of the <code class="option">-4</code> or
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster <code class="option">-6</code> options are in use, then
36bbe86e1acac2b608a7a82a0670ab4bec3e9acdBernhard Thalmayr only addresses for the corresponding transport
36bbe86e1acac2b608a7a82a0670ab4bec3e9acdBernhard Thalmayr will be tried. If no usable addresses are found,
36bbe86e1acac2b608a7a82a0670ab4bec3e9acdBernhard Thalmayr <span><strong class="command">delv</strong></span> will send queries to
36bbe86e1acac2b608a7a82a0670ab4bec3e9acdBernhard Thalmayr the localhost addresses (127.0.0.1 for IPv4,
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster ::1 for IPv6).
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster<dt><span class="term"><code class="constant">name</code></span></dt>
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster is the domain name to be looked up.
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major<dt><span class="term"><code class="constant">type</code></span></dt>
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major indicates what type of query is required —
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major ANY, A, MX, etc.
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major <em class="parameter"><code>type</code></em> can be any valid query
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major <em class="parameter"><code>type</code></em> argument is supplied,
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major <span><strong class="command">delv</strong></span> will perform a lookup for an
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major<dt><span class="term">-a <em class="replaceable"><code>anchor-file</code></em></span></dt>
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major Specifies a file from which to read DNSSEC trust anchors.
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster The default is <code class="filename">/etc/bind.keys</code>, which
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster is included with <acronym class="acronym">BIND</acronym> 9 and contains
1067e734d6cec73ee954f2e43c1bba0e09d267cfPhill Cunnington trust anchors for the root zone (".") and for the ISC
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major DNSSEC lookaside validation zone ("dlv.isc.org").
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster Keys that do not match the root or DLV trust-anchor
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major names are ignored; these key names can be overridden
1067e734d6cec73ee954f2e43c1bba0e09d267cfPhill Cunnington using the <code class="option">+dlv=NAME</code> or
1067e734d6cec73ee954f2e43c1bba0e09d267cfPhill Cunnington <code class="option">+root=NAME</code> options.
36bbe86e1acac2b608a7a82a0670ab4bec3e9acdBernhard Thalmayr Note: When reading the trust anchor file,
1067e734d6cec73ee954f2e43c1bba0e09d267cfPhill Cunnington <span><strong class="command">delv</strong></span> treats <code class="option">managed-keys</code>
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster statements and <code class="option">trusted-keys</code> statements
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster identically. That is, for a managed key, it is the
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major <span class="emphasis"><em>initial</em></span> key that is trusted; RFC 5011
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major key management is not supported. <span><strong class="command">delv</strong></span>
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster will not consult the managed-keys database maintained by
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster <span><strong class="command">named</strong></span>. This means that if either of the
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster keys in <code class="filename">/etc/bind.keys</code> is revoked
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major and rolled over, it will be necessary to update
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major <code class="filename">/etc/bind.keys</code> to use DNSSEC
94f731b658a0a66464a1c7d3225247c8573b161fPeter Major validation in <span><strong class="command">delv</strong></span>.
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster<dt><span class="term">-b <em class="replaceable"><code>address</code></em></span></dt>
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster Sets the source IP address of the query to
1067e734d6cec73ee954f2e43c1bba0e09d267cfPhill Cunnington <em class="parameter"><code>address</code></em>. This must be a valid address
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster on one of the host's network interfaces or "0.0.0.0" or "::".
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster An optional source port may be specified by appending
e95a5abe17a660409891702752e135e38348005dJaco Jooste "#<port>"
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster Sets the query class for the requested data. Currently,
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster only class "IN" is supported in <span><strong class="command">delv</strong></span>
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster and any other value is ignored.
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster<dt><span class="term">-d <em class="replaceable"><code>level</code></em></span></dt>
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster Set the systemwide debug level to <code class="option">level</code>.
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster The allowed range is from 0 to 99.
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster The default is 0 (no debugging).
f2bd66b4677bf27f7ea709e9bfb1ae87080ac5ebKohei Tamura Debugging traces from <span><strong class="command">delv</strong></span> become
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster more verbose as the debug level increases.
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster See the <code class="option">+mtrace</code>, <code class="option">+rtrace</code>,
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster and <code class="option">+vtrace</code> options below for additional
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster debugging details.
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster Display the <span><strong class="command">delv</strong></span> help usage output and exit.
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster Insecure mode. This disables internal DNSSEC validation.
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster (Note, however, this does not set the CD bit on upstream
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster queries. If the server being queried is performing DNSSEC
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster validation, then it will not return invalid data; this
1067e734d6cec73ee954f2e43c1bba0e09d267cfPhill Cunnington can cause <span><strong class="command">delv</strong></span> to time out. When it
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster is necessary to examine invalid data to debug a DNSSEC
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster problem, use <span><strong class="command">dig +cd</strong></span>.)
1067e734d6cec73ee954f2e43c1bba0e09d267cfPhill Cunnington Enables memory usage debugging.
1067e734d6cec73ee954f2e43c1bba0e09d267cfPhill Cunnington<dt><span class="term">-p <em class="replaceable"><code>port#</code></em></span></dt>
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster Specifies a destination port to use for queries instead of
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster the standard DNS port number 53. This option would be used
1067e734d6cec73ee954f2e43c1bba0e09d267cfPhill Cunnington with a name server that has been configured to listen
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster for queries on a non-standard port number.
e95a5abe17a660409891702752e135e38348005dJaco Jooste<dt><span class="term">-q <em class="replaceable"><code>name</code></em></span></dt>
f2bd66b4677bf27f7ea709e9bfb1ae87080ac5ebKohei Tamura Sets the query name to <em class="parameter"><code>name</code></em>.
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster While the query name can be specified without using the
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster <code class="option">-q</code>, it is sometimes necessary to disambiguate
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster names from types or classes (for example, when looking up the
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster name "ns", which could be misinterpreted as the type NS,
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster or "ch", which could be misinterpreted as class CH).
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster Sets the query type to <em class="parameter"><code>type</code></em>, which
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster can be any valid query type supported in BIND 9 except
1067e734d6cec73ee954f2e43c1bba0e09d267cfPhill Cunnington for zone transfer types AXFR and IXFR. As with
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster <code class="option">-q</code>, this is useful to distinguish
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster query name type or class when they are ambiguous.
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster it is sometimes necessary to disambiguate names from types.
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster The default query type is "A", unless the <code class="option">-x</code>
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster option is supplied to indicate a reverse lookup, in which case
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster it is "PTR".
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster Print the <span><strong class="command">delv</strong></span> version and exit.
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster<dt><span class="term">-x <em class="replaceable"><code>addr</code></em></span></dt>
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster Performs a reverse lookup, mapping an addresses to
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster a name. <em class="parameter"><code>addr</code></em> is an IPv4 address in
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster dotted-decimal notation, or a colon-delimited IPv6 address.
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster When <code class="option">-x</code> is used, there is no need to provide
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster the <em class="parameter"><code>name</code></em> or <em class="parameter"><code>type</code></em>
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster arguments. <span><strong class="command">delv</strong></span> automatically performs a
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster lookup for a name like <code class="literal">11.12.13.10.in-addr.arpa</code>
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster and sets the query type to PTR. IPv6 addresses are looked up
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster using nibble format under the IP6.ARPA domain.
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster Forces <span><strong class="command">delv</strong></span> to only use IPv4.
2d0a88b18a041738cfe635b45bd1db56af469c91Allan Foster Forces <span><strong class="command">delv</strong></span> to only use IPv6.
e.g. "[ key id = value ]".
a trust anchor of "dlv.isc.org", for which there is a