man.delv.html revision cefd74ae81cf51692af3a38c1330261a5110fca7
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
7a2a1b8b14fc804ac80612d7b98064095e445be5Automatic Updater - Copyright (C) 2000-2003 Internet Software Consortium.
1167fc7904c5f0a472f8df207ac46dd52c7f1ec8Automatic Updater - Permission to use, copy, modify, and/or distribute this software for any
0c39b3ed9409ecb277d5e32fa763a4e4d6598df8Automatic Updater - purpose with or without fee is hereby granted, provided that the above
46da3117812814a29432a8d9a9ccf8acdbfdadceAutomatic Updater - copyright notice and this permission notice appear in all copies.
fe84edc17e0d582cf7b4270f8df9d4742a107b1cAutomatic Updater - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
79b273c187a4aa1016a62181983dfdd0521681aeMark Andrews - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
b253dcf9668f95e141bce9556dc88e30d3305a1dTinderbox User - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User - PERFORMANCE OF THIS SOFTWARE.
3cc98b8ecedcbc8465f1cf2740b966b315662430Automatic Updater<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
a01aa536188bb3535dfc1107a623e6355a8e6b7cMark Andrews<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
89623368b8f662d458d9964b923050f33c5f75b0Tinderbox User<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<link rel="prev" href="man.host.html" title="host">
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater<link rel="next" href="man.dnssec-checkds.html" title="dnssec-checkds">
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater<table width="100%" summary="Navigation header">
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater<tr><th colspan="3" align="center">delv</th></tr>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<a accesskey="p" href="man.host.html">Prev</a>�</td>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<th width="60%" align="center">Manual pages</th>
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-checkds.html">Next</a>
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt<a name="man.delv"></a><div class="titlepage"></div>
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt<p>delv — DNS lookup and validation utility</p>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<div class="cmdsynopsis"><p><code class="command">delv</code> [@server] [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-a <em class="replaceable"><code>anchor-file</code></em></code>] [<code class="option">-b <em class="replaceable"><code>address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>level</code></em></code>] [<code class="option">-i</code>] [<code class="option">-m</code>] [<code class="option">-p <em class="replaceable"><code>port#</code></em></code>] [<code class="option">-q <em class="replaceable"><code>name</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-x <em class="replaceable"><code>addr</code></em></code>] [name] [type] [class] [queryopt...]</p></div>
cdfc81e048bd34c1d628380247bda6b80a89e20eAutomatic Updater<div class="cmdsynopsis"><p><code class="command">delv</code> [<code class="option">-h</code>]</p></div>
cdfc81e048bd34c1d628380247bda6b80a89e20eAutomatic Updater<div class="cmdsynopsis"><p><code class="command">delv</code> [<code class="option">-v</code>]</p></div>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<div class="cmdsynopsis"><p><code class="command">delv</code> [queryopt...] [query...]</p></div>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<a name="id2615558"></a><h2>DESCRIPTION</h2>
eabc9c3c07cd956d3c436bd7614cb162dabdda76Mark Andrews<p><span><strong class="command">delv</strong></span>
eabc9c3c07cd956d3c436bd7614cb162dabdda76Mark Andrews (Domain Entity Lookup & Validation) is a tool for sending
eabc9c3c07cd956d3c436bd7614cb162dabdda76Mark Andrews DNS queries and validating the results, using the the same internal
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User resolver and validator logic as <span><strong class="command">named</strong></span>.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater <span><strong class="command">delv</strong></span> will send to a specified name server all
8e9f3b69914ee02a80b87c97b1f8093edb3e9ae0Automatic Updater queries needed to fetch and validate the requested data; this
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews includes the original requested query, subsequent queries to follow
930f6069e5aa157cf6987cdafd412f5757a5a558Automatic Updater CNAME or DNAME chains, and queries for DNSKEY, DS and DLV records
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews to establish a chain of trust for DNSSEC validation.
930f6069e5aa157cf6987cdafd412f5757a5a558Automatic Updater It does not perform iterative resolution, but simulates the
80faf1588895fd26490f82f95a7a1b771df1c324Automatic Updater behavior of a name server configured for DNSSEC validating and
114f7780384371121918624ae2c80ecfce545683Tinderbox User By default, responses are validated using built-in DNSSEC trust
693c4232dfdffaff672197d4b9fea944c64cf80aAutomatic Updater anchors for the root zone (".") and for the ISC DNSSEC lookaside
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews validation zone ("dlv.isc.org"). Records returned by
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater <span><strong class="command">delv</strong></span> are either fully validated or
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson were not signed. If validation fails, an explanation of
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater the failure is included in the output; the validation process
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater can be traced in detail. Because <span><strong class="command">delv</strong></span> does
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews not rely on an external server to carry out validation, it can
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater be used to check the validity of DNS responses in environments
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson where local name servers may not be trustworthy.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson Unless it is told to query a specific name server,
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater <span><strong class="command">delv</strong></span> will try each of the servers listed in
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <code class="filename">/etc/resolv.conf</code>. If no usable server
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews addresses are found, <span><strong class="command">delv</strong></span> will send
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews queries to the localhost addresses (127.0.0.1 for IPv4, ::1
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont When no command line arguments or options are given,
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User <span><strong class="command">delv</strong></span> will perform an NS query for "."
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User (the root zone).
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews A typical invocation of <span><strong class="command">delv</strong></span> looks like:
24bf1e02f03577db0feb50b80238c4150c96d05dAutomatic Updater<pre class="programlisting"> delv @server name type </pre>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="term"><code class="constant">server</code></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews is the name or IP address of the name server to query. This
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews can be an IPv4 address in dotted-decimal notation or an IPv6
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews address in colon-delimited notation. When the supplied
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews <em class="parameter"><code>server</code></em> argument is a hostname,
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews <span><strong class="command">delv</strong></span> resolves that name before
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews querying that name server (note, however, that this
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews initial lookup is <span class="emphasis"><em>not</em></span> validated
fe80a4909bf62b602feaf246866e9d29f7654194Automatic Updater If no <em class="parameter"><code>server</code></em> argument is
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater provided, <span><strong class="command">delv</strong></span> consults
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater <code class="filename">/etc/resolv.conf</code>; if an
fe80a4909bf62b602feaf246866e9d29f7654194Automatic Updater address is found there, it queries the name server at
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater that address. If either of the <code class="option">-4</code> or
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater <code class="option">-6</code> options are in use, then
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson only addresses for the corresponding transport
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater will be tried. If no usable addresses are found,
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews <span><strong class="command">delv</strong></span> will send queries to
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson the localhost addresses (127.0.0.1 for IPv4,
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater ::1 for IPv6).
133e6d43fa82e80d3798be4de00f4540f485ec6cAutomatic Updater<dt><span class="term"><code class="constant">name</code></span></dt>
133e6d43fa82e80d3798be4de00f4540f485ec6cAutomatic Updater is the domain name to be looked up.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson<dt><span class="term"><code class="constant">type</code></span></dt>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User indicates what type of query is required —
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User ANY, A, MX, etc.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <em class="parameter"><code>type</code></em> can be any valid query
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <em class="parameter"><code>type</code></em> argument is supplied,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">delv</strong></span> will perform a lookup for an
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater<dt><span class="term">-a <em class="replaceable"><code>anchor-file</code></em></span></dt>
9c446b72069d0ab9f710502f4d7048e50875fccbAutomatic Updater Specifies a file from which to read DNSSEC trust anchors.
e85565067cf73f8cc21ee29b11761659f1d47ee9Automatic Updater The default is <code class="filename">/etc/bind.keys</code>, which
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater is included with <acronym class="acronym">BIND</acronym> 9 and contains
bc0a53583d92309bebcf93c408e2f3247ebd3d3cAutomatic Updater trust anchors for the root zone (".") and for the ISC
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater DNSSEC lookaside validation zone ("dlv.isc.org").
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Keys that do not match the root or DLV trust-anchor
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater names are ignored; these key names can be overridden
7f79131f9a8e804b93c57f3c679065cce878b726Automatic Updater using the <code class="option">+dlv=NAME</code> or
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater <code class="option">+root=NAME</code> options.
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater Note: When reading the trust anchor file,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">delv</strong></span> treats <code class="option">managed-keys</code>
19b3dc94bce93fa76bd7e066f9298630dbc9dcb4Automatic Updater statements and <code class="option">trusted-keys</code> statements
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater identically. That is, for a managed key, it is the
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater <span class="emphasis"><em>initial</em></span> key that is trusted; RFC 5011
7f94d9a8162c9a96b56e66176702b66e79d8e1a2Automatic Updater key management is not supported. <span><strong class="command">delv</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater will not consult the managed-keys database maintained by
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">named</strong></span>. This means that if either of the
5ecad47f69b3fd945472ab2900a9ff826a7ce2f6Automatic Updater keys in <code class="filename">/etc/bind.keys</code> is revoked
e130ab53e992670e2a2ecf043976ac09f21358d1Automatic Updater and rolled over, it will be necessary to update
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <code class="filename">/etc/bind.keys</code> to use DNSSEC
71bd43eebd9d6e42dbcae62b730f5b6508d5acd8Automatic Updater validation in <span><strong class="command">delv</strong></span>.
96ea71632887c58a9d00f47eb318bf76b35903c3Mark Andrews<dt><span class="term">-b <em class="replaceable"><code>address</code></em></span></dt>
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater Sets the source IP address of the query to
bbb069be941f649228760edcc241122933c066d2Automatic Updater <em class="parameter"><code>address</code></em>. This must be a valid address
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater on one of the host's network interfaces or "0.0.0.0" or "::".
4cda4fd158d6ded5586bacea8c388445d99611eaAutomatic Updater An optional source port may be specified by appending
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews "#<port>"
80faf1588895fd26490f82f95a7a1b771df1c324Automatic Updater<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Sets the query class for the requested data. Currently,
a382ca49c874d38ad3ac8995b49f9f27128e4ca9Automatic Updater only class "IN" is supported in <span><strong class="command">delv</strong></span>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews and any other value is ignored.
89623368b8f662d458d9964b923050f33c5f75b0Tinderbox User<dt><span class="term">-d <em class="replaceable"><code>level</code></em></span></dt>
cafd3a2b9974fe0a4ab95e0289746062bd958d68Automatic Updater Set the systemwide debug level to <code class="option">level</code>.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews The allowed range is from 0 to 99.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The default is 0 (no debugging).
7a2a1b8b14fc804ac80612d7b98064095e445be5Automatic Updater Debugging traces from <span><strong class="command">delv</strong></span> become
f132a836c4e386b1af045dd8fe7106ae61b90bffAutomatic Updater more verbose as the debug level increases.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater See the <code class="option">+mtrace</code>, <code class="option">+rtrace</code>,
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User and <code class="option">+vtrace</code> options below for additional
f7a71eef29bcbf892270460269c79664f600cffdAutomatic Updater debugging details.
cf7e98f59148b559946a7f1ca728471374f1eef3Automatic Updater Display the <span><strong class="command">delv</strong></span> help usage output and exit.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Insecure mode. This disables internal DNSSEC validation.
cf7e98f59148b559946a7f1ca728471374f1eef3Automatic Updater (Note, however, this does not set the CD bit on upstream
c3fd32ed29e9e419bb56583f4272a506773b1ea0Automatic Updater queries. If the server being queried is performing DNSSEC
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson validation, then it will not return invalid data; this
c3fd32ed29e9e419bb56583f4272a506773b1ea0Automatic Updater can cause <span><strong class="command">delv</strong></span> to time out. When it
c3fd32ed29e9e419bb56583f4272a506773b1ea0Automatic Updater is necessary to examine invalid data to debug a DNSSEC
a382ca49c874d38ad3ac8995b49f9f27128e4ca9Automatic Updater problem, use <span><strong class="command">dig +cd</strong></span>.)
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Enables memory usage debugging.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<dt><span class="term">-p <em class="replaceable"><code>port#</code></em></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews Specifies a destination port to use for queries instead of
9174e44c14b1cb91a651fa1dc29470438c246ab9Automatic Updater the standard DNS port number 53. This option would be used
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson with a name server that has been configured to listen
e2caa7536302de34de6cc04025abcd53dc3a499aAutomatic Updater for queries on a non-standard port number.
8292deab031e7599cd7622aa7675fbe139ca6095Mark Andrews<dt><span class="term">-q <em class="replaceable"><code>name</code></em></span></dt>
0b57424d28c9a67018107133f9fbc0a7dcf057e2Mark Andrews Sets the query name to <em class="parameter"><code>name</code></em>.
0b57424d28c9a67018107133f9fbc0a7dcf057e2Mark Andrews While the query name can be specified without using the
dc11390a658e02e1a03accd4dbe14c94fa9de556Automatic Updater <code class="option">-q</code>, it is sometimes necessary to disambiguate
08d53af7d51409036462fa80fb1bde7a8c2ac123Automatic Updater names from types or classes (for example, when looking up the
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews name "ns", which could be misinterpreted as the type NS,
b109432c3a939bff66a463be86c371bd88efe3aaAutomatic Updater or "ch", which could be misinterpreted as class CH).
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
7d12a6b412fe47e6d6582923fd6954ab8cd0baebAutomatic Updater Sets the query type to <em class="parameter"><code>type</code></em>, which
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews can be any valid query type supported in BIND 9 except
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews for zone transfer types AXFR and IXFR. As with
3351ccbd5c1961404044f8273d54dad405f53960Mark Andrews <code class="option">-q</code>, this is useful to distinguish
7d12a6b412fe47e6d6582923fd6954ab8cd0baebAutomatic Updater query name type or class when they are ambiguous.
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews it is sometimes necessary to disambiguate names from types.
0b57424d28c9a67018107133f9fbc0a7dcf057e2Mark Andrews The default query type is "A", unless the <code class="option">-x</code>
e8fc8c884b44371784805e1e0d3100da403dd3f1Automatic Updater option is supplied to indicate a reverse lookup, in which case
e8fc8c884b44371784805e1e0d3100da403dd3f1Automatic Updater Print the <span><strong class="command">delv</strong></span> version and exit.
e8fc8c884b44371784805e1e0d3100da403dd3f1Automatic Updater<dt><span class="term">-x <em class="replaceable"><code>addr</code></em></span></dt>
b253dcf9668f95e141bce9556dc88e30d3305a1dTinderbox User Performs a reverse lookup, mapping an addresses to
b253dcf9668f95e141bce9556dc88e30d3305a1dTinderbox User a name. <em class="parameter"><code>addr</code></em> is an IPv4 address in
b253dcf9668f95e141bce9556dc88e30d3305a1dTinderbox User dotted-decimal notation, or a colon-delimited IPv6 address.
b253dcf9668f95e141bce9556dc88e30d3305a1dTinderbox User When <code class="option">-x</code> is used, there is no need to provide
b253dcf9668f95e141bce9556dc88e30d3305a1dTinderbox User the <em class="parameter"><code>name</code></em> or <em class="parameter"><code>type</code></em>
b253dcf9668f95e141bce9556dc88e30d3305a1dTinderbox User arguments. <span><strong class="command">delv</strong></span> automatically performs a
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User lookup for a name like <code class="literal">11.12.13.10.in-addr.arpa</code>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User and sets the query type to PTR. IPv6 addresses are looked up
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater using nibble format under the IP6.ARPA domain.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews Forces <span><strong class="command">delv</strong></span> to only use IPv4.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews Forces <span><strong class="command">delv</strong></span> to only use IPv6.
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater<a name="id2671470"></a><h2>QUERY OPTIONS</h2>
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews<p><span><strong class="command">delv</strong></span>
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews provides a number of query options which affect the way results are
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User displayed, and in some cases the way lookups are performed.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Each query option is identified by a keyword preceded by a plus sign
f7369b2881b5e63d69600adcedc8ba938303d30cTinderbox User (<code class="literal">+</code>). Some keywords set or reset an
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User option. These may be preceded by the string
b13d89bd89878137c81b36a36596cca3920f27a4Automatic Updater <code class="literal">no</code> to negate the meaning of that keyword.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Other keywords assign values to options like the timeout interval.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User They have the form <code class="option">+keyword=value</code>.
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater The query options are:
bc0a4c01beede169df81a3ee5b614ed9e82339dbAutomatic Updater<dt><span class="term"><code class="option">+[no]cdflag</code></span></dt>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Controls whether to set the CD (checking disabled) bit in
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington queries sent by <span><strong class="command">delv</strong></span>. This may be useful
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington when troubleshooting DNSSEC problems from behind a validating
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington resolver. A validating resolver will block invalid responses,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington making it difficult to retrieve them for analysis. Setting
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington the CD flag on queries will cause the resolver to return
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington invalid responses, which <span><strong class="command">delv</strong></span> can then
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington validate internally and report the errors in detail.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<dt><span class="term"><code class="option">+[no]class</code></span></dt>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Controls whether to display the CLASS when printing
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington a record. The default is to display the CLASS.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<dt><span class="term"><code class="option">+[no]ttl</code></span></dt>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Controls whether to display the TTL when printing
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington a record. The default is to display the TTL.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<dt><span class="term"><code class="option">+[no]rtrace</code></span></dt>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Toggle resolver fetch logging. This reports the
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington name and type of each query sent by <span><strong class="command">delv</strong></span>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington in the process of carrying out the resolution and validation
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington process: this includes including the original query and
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington all subsequent queries to follow CNAMEs and to establish a
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington chain of trust for DNSSEC validation.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington This is equivalent to setting the debug level to 1 in
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington the "resolver" logging category. Setting the systemwide
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington debug level to 1 using the <code class="option">-d</code> option will
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington product the same output (but will affect other logging
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington categories as well).
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<dt><span class="term"><code class="option">+[no]mtrace</code></span></dt>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Toggle message logging. This produces a detailed dump of
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington the responses received by <span><strong class="command">delv</strong></span> in the
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington process of carrying out the resolution and validation process.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington This is equivalent to setting the debug level to 10
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington for the the "packets" module of the "resolver" logging
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington category. Setting the systemwide debug level to 10 using
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington the <code class="option">-d</code> option will produce the same output
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington (but will affect other logging categories as well).
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater<dt><span class="term"><code class="option">+[no]vtrace</code></span></dt>
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater Toggle validation logging. This shows the internal
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater process of the validator as it determines whether an
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater answer is validly signed, unsigned, or invalid.
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater This is equivalent to setting the debug level to 3
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater for the the "validator" module of the "dnssec" logging
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater category. Setting the systemwide debug level to 3 using
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater the <code class="option">-d</code> option will produce the same output
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater (but will affect other logging categories as well).
ec8755f605d7dcb2de1076040e77bc2d7ec33b4aTinderbox User<dt><span class="term"><code class="option">+[no]short</code></span></dt>
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington Provide a terse answer. The default is to print the answer in a
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington verbose form.
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews<dt><span class="term"><code class="option">+[no]comments</code></span></dt>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Toggle the display of comment lines in the output. The default
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews is to print comments.
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews<dt><span class="term"><code class="option">+[no]rrcomments</code></span></dt>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Toggle the display of per-record comments in the output (for
6c6a121295b30772cbf3dd75a51fb9d883051a0eAutomatic Updater example, human-readable key information about DNSKEY records).
099b86fb8136a7dff81df85cf395978c16eb254cAutomatic Updater The default is to print per-record comments.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<dt><span class="term"><code class="option">+[no]crypto</code></span></dt>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Toggle the display of cryptographic fields in DNSSEC records.
e10d61d84e0b735f1e8eca18644cfdb1b06cad33Tinderbox User The contents of these field are unnecessary to debug most DNSSEC
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater validation failures and removing them makes it easier to see
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the common failures. The default is to display the fields.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater When omitted they are replaced by the string "[omitted]" or
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater in the DNSKEY case the key id is displayed as the replacement,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater e.g. "[ key id = value ]".
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term"><code class="option">+[no]trust</code></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Controls whether to display the trust level when printing
c01dec514a81ecf8c17ca3ef8c3ba95e437295ebAutomatic Updater a record. The default is to display the trust level.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><code class="option">+[no]split[=W]</code></span></dt>
3de6db3208d51de1e138b63b9670430c03f99694Automatic Updater Split long hex- or base64-formatted fields in resource
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater records into chunks of <em class="parameter"><code>W</code></em> characters
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater (where <em class="parameter"><code>W</code></em> is rounded up to the nearest
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User multiple of 4).
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <em class="parameter"><code>+nosplit</code></em> or
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <em class="parameter"><code>+split=0</code></em> causes fields not to be
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington split at all. The default is 56 characters, or 44 characters
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington when multiline mode is active.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<dt><span class="term"><code class="option">+[no]all</code></span></dt>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Set or clear the display options
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <code class="option">+[no]rrcomments</code>, and
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <code class="option">+[no]trust</code> as a group.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<dt><span class="term"><code class="option">+[no]multiline</code></span></dt>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Print long records (such as RRSIG, DNSKEY, and SOA records)
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington in a verbose multi-line format with human-readable comments.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington The default is to print each record on a single line, to
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington facilitate machine parsing of the <span><strong class="command">delv</strong></span>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<dt><span class="term"><code class="option">+[no]dnssec</code></span></dt>
e130ab53e992670e2a2ecf043976ac09f21358d1Automatic Updater Indicates whether to display RRSIG records in the
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater <span><strong class="command">delv</strong></span> output. The default is to
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User do so. Note that (unlike in <span><strong class="command">dig</strong></span>)
a26b22914b7bf25f065afb8cdef983766dcd672bAutomatic Updater this does <span class="emphasis"><em>not</em></span> control whether to
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater request DNSSEC records or whether to validate them.
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater DNSSEC records are always requested, and validation
79cea03ba823e2d3a34895f0ba91d7fb5ad799e7Automatic Updater will always occur unless suppressed by the use of
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <code class="option">-i</code> or <code class="option">+noroot</code> and
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews<dt><span class="term"><code class="option">+[no]root[=ROOT]</code></span></dt>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Indicates whether to perform conventional (non-lookaside)
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington DNSSEC validation, and if so, specifies the
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington name of a trust anchor. The default is to validate using
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington a trust anchor of "." (the root zone), for which there is
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington a built-in key. If specifying a different trust anchor,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington then <code class="option">-a</code> must be used to specify a file
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington containing the key.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<dt><span class="term"><code class="option">+[no]dlv[=DLV]</code></span></dt>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Indicates whether to perform DNSSEC lookaside validation,
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews and if so, specifies the name of the DLV trust anchor.
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews The default is to perform lookaside validation using
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington a trust anchor of "dlv.isc.org", for which there is a
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington built-in key. If specifying a different name, then
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews <code class="option">-a</code> must be used to specify a file
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington containing the DLV key.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<p><code class="filename">/etc/bind.keys</code></p>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<p><code class="filename">/etc/resolv.conf</code></p>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<table width="100%" summary="Navigation footer">
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews<a accesskey="p" href="man.host.html">Prev</a>�</td>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-checkds.html">Next</a>
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews<td width="40%" align="left" valign="top">host�</td>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<td width="40%" align="right" valign="top">�<span class="application">dnssec-checkds</span>