man.delv.html revision a1ff871f78b7d907d6fc3a382beea2a640fe8423
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - Copyright (C) 2000-2003 Internet Software Consortium.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - Permission to use, copy, modify, and/or distribute this software for any
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - purpose with or without fee is hereby granted, provided that the above
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - copyright notice and this permission notice appear in all copies.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster - PERFORMANCE OF THIS SOFTWARE.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<link rel="prev" href="man.host.html" title="host">
2075f399f27e30aaf713035e00b82e75bbb58f4cPeter Major<link rel="next" href="man.dnssec-checkds.html" title="dnssec-checkds">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<table width="100%" summary="Navigation header">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<tr><th colspan="3" align="center">delv</th></tr>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<a accesskey="p" href="man.host.html">Prev</a>�</td>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<th width="60%" align="center">Manual pages</th>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-checkds.html">Next</a>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<a name="man.delv"></a><div class="titlepage"></div>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<p>delv — DNS lookup and validation utility</p>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<div class="cmdsynopsis"><p><code class="command">delv</code> [@server] [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-a <em class="replaceable"><code>anchor-file</code></em></code>] [<code class="option">-b <em class="replaceable"><code>address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>level</code></em></code>] [<code class="option">-i</code>] [<code class="option">-m</code>] [<code class="option">-p <em class="replaceable"><code>port#</code></em></code>] [<code class="option">-q <em class="replaceable"><code>name</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-x <em class="replaceable"><code>addr</code></em></code>] [name] [type] [class] [queryopt...]</p></div>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<div class="cmdsynopsis"><p><code class="command">delv</code> [<code class="option">-h</code>]</p></div>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<div class="cmdsynopsis"><p><code class="command">delv</code> [<code class="option">-v</code>]</p></div>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<div class="cmdsynopsis"><p><code class="command">delv</code> [queryopt...] [query...]</p></div>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<p><span class="command"><strong>delv</strong></span>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster (Domain Entity Lookup & Validation) is a tool for sending
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster DNS queries and validating the results, using the same internal
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster resolver and validator logic as <span class="command"><strong>named</strong></span>.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <span class="command"><strong>delv</strong></span> will send to a specified name server all
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster queries needed to fetch and validate the requested data; this
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster includes the original requested query, subsequent queries to follow
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster CNAME or DNAME chains, and queries for DNSKEY, DS and DLV records
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster to establish a chain of trust for DNSSEC validation.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster It does not perform iterative resolution, but simulates the
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster behavior of a name server configured for DNSSEC validating and
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest By default, responses are validated using built-in DNSSEC trust
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest anchors for the root zone (".") and for the ISC DNSSEC lookaside
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest validation zone ("dlv.isc.org"). Records returned by
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest <span class="command"><strong>delv</strong></span> are either fully validated or
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest were not signed. If validation fails, an explanation of
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest the failure is included in the output; the validation process
882df6887ad52745d38d9bf0d92b3ac6f7703126Peter Major can be traced in detail. Because <span class="command"><strong>delv</strong></span> does
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest not rely on an external server to carry out validation, it can
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest be used to check the validity of DNS responses in environments
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest where local name servers may not be trustworthy.
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest Unless it is told to query a specific name server,
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest <span class="command"><strong>delv</strong></span> will try each of the servers listed in
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <code class="filename">/etc/resolv.conf</code>. If no usable server
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster addresses are found, <span class="command"><strong>delv</strong></span> will send
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster queries to the localhost addresses (127.0.0.1 for IPv4, ::1
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster When no command line arguments or options are given,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <span class="command"><strong>delv</strong></span> will perform an NS query for "."
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster (the root zone).
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster A typical invocation of <span class="command"><strong>delv</strong></span> looks like:
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest<pre class="programlisting"> delv @server name type </pre>
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest<div class="variablelist"><dl class="variablelist">
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest<dt><span class="term"><code class="constant">server</code></span></dt>
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest is the name or IP address of the name server to query. This
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest can be an IPv4 address in dotted-decimal notation or an IPv6
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest address in colon-delimited notation. When the supplied
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest <em class="parameter"><code>server</code></em> argument is a hostname,
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest <span class="command"><strong>delv</strong></span> resolves that name before
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest querying that name server (note, however, that this
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest initial lookup is <span class="emphasis"><em>not</em></span> validated
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest If no <em class="parameter"><code>server</code></em> argument is
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest provided, <span class="command"><strong>delv</strong></span> consults
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest <code class="filename">/etc/resolv.conf</code>; if an
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest address is found there, it queries the name server at
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest that address. If either of the <code class="option">-4</code> or
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest <code class="option">-6</code> options are in use, then
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest only addresses for the corresponding transport
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest will be tried. If no usable addresses are found,
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest <span class="command"><strong>delv</strong></span> will send queries to
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest the localhost addresses (127.0.0.1 for IPv4,
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest ::1 for IPv6).
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest<dt><span class="term"><code class="constant">name</code></span></dt>
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest is the domain name to be looked up.
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest<dt><span class="term"><code class="constant">type</code></span></dt>
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest indicates what type of query is required —
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest ANY, A, MX, etc.
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest <em class="parameter"><code>type</code></em> can be any valid query
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest <em class="parameter"><code>type</code></em> argument is supplied,
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest <span class="command"><strong>delv</strong></span> will perform a lookup for an
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest<div class="variablelist"><dl class="variablelist">
0fdab8904a8fe223f6934b878769fe45e7651c60Andrew Forrest<dt><span class="term">-a <em class="replaceable"><code>anchor-file</code></em></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Specifies a file from which to read DNSSEC trust anchors.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster The default is <code class="filename">/etc/bind.keys</code>, which
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster is included with <acronym class="acronym">BIND</acronym> 9 and contains
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster trust anchors for the root zone (".") and for the ISC
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster DNSSEC lookaside validation zone ("dlv.isc.org").
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Keys that do not match the root or DLV trust-anchor
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster names are ignored; these key names can be overridden
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster using the <code class="option">+dlv=NAME</code> or
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <code class="option">+root=NAME</code> options.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Note: When reading the trust anchor file,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <span class="command"><strong>delv</strong></span> treats <code class="option">managed-keys</code>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster statements and <code class="option">trusted-keys</code> statements
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster identically. That is, for a managed key, it is the
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <span class="emphasis"><em>initial</em></span> key that is trusted; RFC 5011
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster key management is not supported. <span class="command"><strong>delv</strong></span>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster will not consult the managed-keys database maintained by
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <span class="command"><strong>named</strong></span>. This means that if either of the
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster keys in <code class="filename">/etc/bind.keys</code> is revoked
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster and rolled over, it will be necessary to update
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <code class="filename">/etc/bind.keys</code> to use DNSSEC
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster validation in <span class="command"><strong>delv</strong></span>.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term">-b <em class="replaceable"><code>address</code></em></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Sets the source IP address of the query to
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <em class="parameter"><code>address</code></em>. This must be a valid address
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster on one of the host's network interfaces or "0.0.0.0" or "::".
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster An optional source port may be specified by appending
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster "#<port>"
4a48635cccc646ac479830fd4df0ee8e10c5bd8djeff.schenk<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
4a48635cccc646ac479830fd4df0ee8e10c5bd8djeff.schenk Sets the query class for the requested data. Currently,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster only class "IN" is supported in <span class="command"><strong>delv</strong></span>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster and any other value is ignored.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term">-d <em class="replaceable"><code>level</code></em></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Set the systemwide debug level to <code class="option">level</code>.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster The allowed range is from 0 to 99.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster The default is 0 (no debugging).
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Debugging traces from <span class="command"><strong>delv</strong></span> become
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster more verbose as the debug level increases.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster See the <code class="option">+mtrace</code>, <code class="option">+rtrace</code>,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster and <code class="option">+vtrace</code> options below for additional
4a48635cccc646ac479830fd4df0ee8e10c5bd8djeff.schenk debugging details.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Display the <span class="command"><strong>delv</strong></span> help usage output and exit.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Insecure mode. This disables internal DNSSEC validation.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster (Note, however, this does not set the CD bit on upstream
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster queries. If the server being queried is performing DNSSEC
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster validation, then it will not return invalid data; this
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster can cause <span class="command"><strong>delv</strong></span> to time out. When it
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster is necessary to examine invalid data to debug a DNSSEC
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster problem, use <span class="command"><strong>dig +cd</strong></span>.)
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Enables memory usage debugging.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term">-p <em class="replaceable"><code>port#</code></em></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Specifies a destination port to use for queries instead of
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster the standard DNS port number 53. This option would be used
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster with a name server that has been configured to listen
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster for queries on a non-standard port number.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term">-q <em class="replaceable"><code>name</code></em></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Sets the query name to <em class="parameter"><code>name</code></em>.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster While the query name can be specified without using the
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <code class="option">-q</code>, it is sometimes necessary to disambiguate
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster names from types or classes (for example, when looking up the
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster name "ns", which could be misinterpreted as the type NS,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster or "ch", which could be misinterpreted as class CH).
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Sets the query type to <em class="parameter"><code>type</code></em>, which
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster can be any valid query type supported in BIND 9 except
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster for zone transfer types AXFR and IXFR. As with
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <code class="option">-q</code>, this is useful to distinguish
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster query name type or class when they are ambiguous.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster it is sometimes necessary to disambiguate names from types.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster The default query type is "A", unless the <code class="option">-x</code>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster option is supplied to indicate a reverse lookup, in which case
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster it is "PTR".
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Print the <span class="command"><strong>delv</strong></span> version and exit.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term">-x <em class="replaceable"><code>addr</code></em></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Performs a reverse lookup, mapping an addresses to
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster a name. <em class="parameter"><code>addr</code></em> is an IPv4 address in
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster dotted-decimal notation, or a colon-delimited IPv6 address.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster When <code class="option">-x</code> is used, there is no need to provide
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster the <em class="parameter"><code>name</code></em> or <em class="parameter"><code>type</code></em>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster arguments. <span class="command"><strong>delv</strong></span> automatically performs a
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster lookup for a name like <code class="literal">11.12.13.10.in-addr.arpa</code>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster and sets the query type to PTR. IPv6 addresses are looked up
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster using nibble format under the IP6.ARPA domain.
7be5aa496ae10e8d30aa6675df55e074cbb5cfedMark de Reeper Forces <span class="command"><strong>delv</strong></span> to only use IPv4.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Forces <span class="command"><strong>delv</strong></span> to only use IPv6.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<a name="id-1.14.4.10"></a><h2>QUERY OPTIONS</h2>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<p><span class="command"><strong>delv</strong></span>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster provides a number of query options which affect the way results are
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster displayed, and in some cases the way lookups are performed.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Each query option is identified by a keyword preceded by a plus sign
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster (<code class="literal">+</code>). Some keywords set or reset an
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster option. These may be preceded by the string
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <code class="literal">no</code> to negate the meaning of that keyword.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Other keywords assign values to options like the timeout interval.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster They have the form <code class="option">+keyword=value</code>.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster The query options are:
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<div class="variablelist"><dl class="variablelist">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term"><code class="option">+[no]cdflag</code></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Controls whether to set the CD (checking disabled) bit in
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster queries sent by <span class="command"><strong>delv</strong></span>. This may be useful
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster when troubleshooting DNSSEC problems from behind a validating
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster resolver. A validating resolver will block invalid responses,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster making it difficult to retrieve them for analysis. Setting
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster the CD flag on queries will cause the resolver to return
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster invalid responses, which <span class="command"><strong>delv</strong></span> can then
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster validate internally and report the errors in detail.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term"><code class="option">+[no]class</code></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Controls whether to display the CLASS when printing
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster a record. The default is to display the CLASS.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term"><code class="option">+[no]ttl</code></span></dt>
7be5aa496ae10e8d30aa6675df55e074cbb5cfedMark de Reeper Controls whether to display the TTL when printing
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster a record. The default is to display the TTL.
80849398a45dca1fb917716907d6ec99be6222c2Peter Major<dt><span class="term"><code class="option">+[no]rtrace</code></span></dt>
80849398a45dca1fb917716907d6ec99be6222c2Peter Major Toggle resolver fetch logging. This reports the
80849398a45dca1fb917716907d6ec99be6222c2Peter Major name and type of each query sent by <span class="command"><strong>delv</strong></span>
80849398a45dca1fb917716907d6ec99be6222c2Peter Major in the process of carrying out the resolution and validation
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster process: this includes including the original query and
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster all subsequent queries to follow CNAMEs and to establish a
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster chain of trust for DNSSEC validation.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster This is equivalent to setting the debug level to 1 in
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster the "resolver" logging category. Setting the systemwide
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster debug level to 1 using the <code class="option">-d</code> option will
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster product the same output (but will affect other logging
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster categories as well).
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term"><code class="option">+[no]mtrace</code></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Toggle message logging. This produces a detailed dump of
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster the responses received by <span class="command"><strong>delv</strong></span> in the
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster process of carrying out the resolution and validation process.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster This is equivalent to setting the debug level to 10
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster for the "packets" module of the "resolver" logging
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster category. Setting the systemwide debug level to 10 using
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster the <code class="option">-d</code> option will produce the same output
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster (but will affect other logging categories as well).
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term"><code class="option">+[no]vtrace</code></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Toggle validation logging. This shows the internal
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster process of the validator as it determines whether an
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster answer is validly signed, unsigned, or invalid.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster This is equivalent to setting the debug level to 3
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster for the "validator" module of the "dnssec" logging
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster category. Setting the systemwide debug level to 3 using
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster the <code class="option">-d</code> option will produce the same output
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster (but will affect other logging categories as well).
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term"><code class="option">+[no]short</code></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Provide a terse answer. The default is to print the answer in a
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster verbose form.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term"><code class="option">+[no]comments</code></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Toggle the display of comment lines in the output. The default
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster is to print comments.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term"><code class="option">+[no]rrcomments</code></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Toggle the display of per-record comments in the output (for
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster example, human-readable key information about DNSKEY records).
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster The default is to print per-record comments.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term"><code class="option">+[no]crypto</code></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Toggle the display of cryptographic fields in DNSSEC records.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster The contents of these field are unnecessary to debug most DNSSEC
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster validation failures and removing them makes it easier to see
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster the common failures. The default is to display the fields.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster When omitted they are replaced by the string "[omitted]" or
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster in the DNSKEY case the key id is displayed as the replacement,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster e.g. "[ key id = value ]".
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term"><code class="option">+[no]trust</code></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Controls whether to display the trust level when printing
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster a record. The default is to display the trust level.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term"><code class="option">+[no]split[=W]</code></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Split long hex- or base64-formatted fields in resource
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster records into chunks of <em class="parameter"><code>W</code></em> characters
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster (where <em class="parameter"><code>W</code></em> is rounded up to the nearest
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster multiple of 4).
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <em class="parameter"><code>+nosplit</code></em> or
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <em class="parameter"><code>+split=0</code></em> causes fields not to be
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster split at all. The default is 56 characters, or 44 characters
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster when multiline mode is active.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term"><code class="option">+[no]all</code></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Set or clear the display options
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <code class="option">+[no]rrcomments</code>, and
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <code class="option">+[no]trust</code> as a group.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term"><code class="option">+[no]multiline</code></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Print long records (such as RRSIG, DNSKEY, and SOA records)
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster in a verbose multi-line format with human-readable comments.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster The default is to print each record on a single line, to
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster facilitate machine parsing of the <span class="command"><strong>delv</strong></span>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term"><code class="option">+[no]dnssec</code></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Indicates whether to display RRSIG records in the
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <span class="command"><strong>delv</strong></span> output. The default is to
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster do so. Note that (unlike in <span class="command"><strong>dig</strong></span>)
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster this does <span class="emphasis"><em>not</em></span> control whether to
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster request DNSSEC records or whether to validate them.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster DNSSEC records are always requested, and validation
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster will always occur unless suppressed by the use of
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <code class="option">-i</code> or <code class="option">+noroot</code> and
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term"><code class="option">+[no]root[=ROOT]</code></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Indicates whether to perform conventional (non-lookaside)
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster DNSSEC validation, and if so, specifies the
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster name of a trust anchor. The default is to validate using
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster a trust anchor of "." (the root zone), for which there is
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster a built-in key. If specifying a different trust anchor,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster then <code class="option">-a</code> must be used to specify a file
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster containing the key.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term"><code class="option">+[no]dlv[=DLV]</code></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Indicates whether to perform DNSSEC lookaside validation,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster and if so, specifies the name of the DLV trust anchor.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster The default is to perform lookaside validation using
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster a trust anchor of "dlv.isc.org", for which there is a
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster built-in key. If specifying a different name, then
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <code class="option">-a</code> must be used to specify a file
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster containing the DLV key.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term"><code class="option">+[no]tcp</code></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Controls whether to use TCP when sending queries.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster The default is to use UDP unless a truncated
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster response has been received.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<dt><span class="term"><code class="option">+[no]unknownformat</code></span></dt>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Print all RDATA in unknown RR type presentation format
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster (RFC 3597). The default is to print RDATA for known types
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster in the type's presentation format.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<p><code class="filename">/etc/bind.keys</code></p>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<p><code class="filename">/etc/resolv.conf</code></p>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<table width="100%" summary="Navigation footer">
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<a accesskey="p" href="man.host.html">Prev</a>�</td>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-checkds.html">Next</a>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<td width="40%" align="left" valign="top">host�</td>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<td width="40%" align="right" valign="top">�<span class="application">dnssec-checkds</span>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.0b1</p>