man.delv.html revision ebca35d493a0f74b0fb3371b7f19ef80f99f156c
3609dfc9f2733f4dc836c6a6bb3745398f280fcevboxsync - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
3609dfc9f2733f4dc836c6a6bb3745398f280fcevboxsync - Copyright (C) 2000-2003 Internet Software Consortium.
3609dfc9f2733f4dc836c6a6bb3745398f280fcevboxsync - Permission to use, copy, modify, and/or distribute this software for any
3609dfc9f2733f4dc836c6a6bb3745398f280fcevboxsync - purpose with or without fee is hereby granted, provided that the above
5654aa8329bbe2838fa5733f28c1a0461c9e6453vboxsync - copyright notice and this permission notice appear in all copies.
3609dfc9f2733f4dc836c6a6bb3745398f280fcevboxsync - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
3609dfc9f2733f4dc836c6a6bb3745398f280fcevboxsync - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
3609dfc9f2733f4dc836c6a6bb3745398f280fcevboxsync - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
a16eb14ad7a4b5ef91ddc22d3e8e92d930f736fcvboxsync - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
a16eb14ad7a4b5ef91ddc22d3e8e92d930f736fcvboxsync - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
a16eb14ad7a4b5ef91ddc22d3e8e92d930f736fcvboxsync - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
a16eb14ad7a4b5ef91ddc22d3e8e92d930f736fcvboxsync - PERFORMANCE OF THIS SOFTWARE.
3609dfc9f2733f4dc836c6a6bb3745398f280fcevboxsync<!-- $Id$ -->
3609dfc9f2733f4dc836c6a6bb3745398f280fcevboxsync<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
2508d15edddcae0b79002fae3fe103d6c4836810vboxsync<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
43747b1f0bc8302a238fb35e55857a5e9aa1933dvboxsync<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
43747b1f0bc8302a238fb35e55857a5e9aa1933dvboxsync<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
0c437bb10c61b229407a7517efde04dfe3b1e4a1vboxsync<link rel="next" href="man.dnssec-checkds.html" title="dnssec-checkds">
0c437bb10c61b229407a7517efde04dfe3b1e4a1vboxsync<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
7c9a5eca233baf6ede345ace077a00bd0b7af1efvboxsync<a accesskey="p" href="man.host.html">Prev</a>�</td>
7c9a5eca233baf6ede345ace077a00bd0b7af1efvboxsync<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-checkds.html">Next</a>
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync<a name="man.delv"></a><div class="titlepage"></div>
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync<p>delv — DNS lookup and validation utility</p>
289060a0c3cb1d509f2cb01fca060796212376f6vboxsync<div class="cmdsynopsis"><p><code class="command">delv</code> [@server] [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-a <em class="replaceable"><code>anchor-file</code></em></code>] [<code class="option">-b <em class="replaceable"><code>address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>level</code></em></code>] [<code class="option">-i</code>] [<code class="option">-m</code>] [<code class="option">-p <em class="replaceable"><code>port#</code></em></code>] [<code class="option">-q <em class="replaceable"><code>name</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-x <em class="replaceable"><code>addr</code></em></code>] [name] [type] [class] [queryopt...]</p></div>
289060a0c3cb1d509f2cb01fca060796212376f6vboxsync<div class="cmdsynopsis"><p><code class="command">delv</code> [<code class="option">-h</code>]</p></div>
289060a0c3cb1d509f2cb01fca060796212376f6vboxsync<div class="cmdsynopsis"><p><code class="command">delv</code> [<code class="option">-v</code>]</p></div>
289060a0c3cb1d509f2cb01fca060796212376f6vboxsync<div class="cmdsynopsis"><p><code class="command">delv</code> [queryopt...] [query...]</p></div>
6420f75ffc86ab6494eb5e95418f0c95e71e8068vboxsync<p><span><strong class="command">delv</strong></span>
3609dfc9f2733f4dc836c6a6bb3745398f280fcevboxsync (Domain Entity Lookup & Validation) is a tool for sending
3609dfc9f2733f4dc836c6a6bb3745398f280fcevboxsync DNS queries and validating the results, using the the same internal
3609dfc9f2733f4dc836c6a6bb3745398f280fcevboxsync resolver and validator logic as <span><strong class="command">named</strong></span>.
faf968cea88f2ab4bcc3325b17bc8b095a8e3642vboxsync <span><strong class="command">delv</strong></span> will send to a specified name server all
6420f75ffc86ab6494eb5e95418f0c95e71e8068vboxsync queries needed to fetch and validate the requested data; this
436b5c616e019c5e62053657c52d3ab5562ecbbfvboxsync includes the original requested query, subsequent queries to follow
436b5c616e019c5e62053657c52d3ab5562ecbbfvboxsync CNAME or DNAME chains, and queries for DNSKEY, DS and DLV records
3609dfc9f2733f4dc836c6a6bb3745398f280fcevboxsync to establish a chain of trust for DNSSEC validation.
faf968cea88f2ab4bcc3325b17bc8b095a8e3642vboxsync It does not perform iterative resolution, but simulates the
3609dfc9f2733f4dc836c6a6bb3745398f280fcevboxsync behavior of a name server configured for DNSSEC validating and
c7a00ac75c7941df2afb62e6fd7ffdf1795e6c76vboxsync forwarding.
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync By default, responses are validated using built-in DNSSEC trust
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync anchors for the root zone (".") and for the ISC DNSSEC lookaside
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync validation zone ("dlv.isc.org"). Records returned by
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync <span><strong class="command">delv</strong></span> are either fully validated or
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync were not signed. If validation fails, an explanation of
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync the failure is included in the output; the validation process
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync can be traced in detail. Because <span><strong class="command">delv</strong></span> does
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync not rely on an external server to carry out validation, it can
436b5c616e019c5e62053657c52d3ab5562ecbbfvboxsync be used to check the validity of DNS responses in environments
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync where local name servers may not be trustworthy.
436b5c616e019c5e62053657c52d3ab5562ecbbfvboxsync Unless it is told to query a specific name server,
f94f82d66536c7332c347dd9a3a9f0f8c79247f4vboxsync <span><strong class="command">delv</strong></span> will try each of the servers listed in
436b5c616e019c5e62053657c52d3ab5562ecbbfvboxsync <code class="filename">/etc/resolv.conf</code>. If no usable server
436b5c616e019c5e62053657c52d3ab5562ecbbfvboxsync addresses are found, <span><strong class="command">delv</strong></span> will send
43dff6077acb4176145b18bdb862eb73620182d2vboxsync queries to the localhost addresses (127.0.0.1 for IPv4, ::1
436b5c616e019c5e62053657c52d3ab5562ecbbfvboxsync When no command line arguments or options are given,
436b5c616e019c5e62053657c52d3ab5562ecbbfvboxsync <span><strong class="command">delv</strong></span> will perform an NS query for "."
436b5c616e019c5e62053657c52d3ab5562ecbbfvboxsync (the root zone).
436b5c616e019c5e62053657c52d3ab5562ecbbfvboxsync A typical invocation of <span><strong class="command">delv</strong></span> looks like:
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync<pre class="programlisting"> delv @server name type </pre>
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync<dt><span class="term"><code class="constant">server</code></span></dt>
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync is the name or IP address of the name server to query. This
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync can be an IPv4 address in dotted-decimal notation or an IPv6
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync address in colon-delimited notation. When the supplied
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync <em class="parameter"><code>server</code></em> argument is a hostname,
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync <span><strong class="command">delv</strong></span> resolves that name before
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync querying that name server (note, however, that this
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync initial lookup is <span class="emphasis"><em>not</em></span> validated
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync by DNSSEC).
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync If no <em class="parameter"><code>server</code></em> argument is
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync provided, <span><strong class="command">delv</strong></span> consults
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync <code class="filename">/etc/resolv.conf</code>; if an
5654aa8329bbe2838fa5733f28c1a0461c9e6453vboxsync address is found there, it queries the name server at
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync that address. If either of the <code class="option">-4</code> or
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync <code class="option">-6</code> options are in use, then
5654aa8329bbe2838fa5733f28c1a0461c9e6453vboxsync only addresses for the corresponding transport
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync will be tried. If no usable addresses are found,
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync <span><strong class="command">delv</strong></span> will send queries to
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync the localhost addresses (127.0.0.1 for IPv4,
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync ::1 for IPv6).
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync<dt><span class="term"><code class="constant">name</code></span></dt>
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync is the domain name to be looked up.
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync<dt><span class="term"><code class="constant">type</code></span></dt>
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync indicates what type of query is required —
b40179b44fea65b72b2f226f62af1ed7bd3c48fcvboxsync ANY, A, MX, etc.
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync <em class="parameter"><code>type</code></em> can be any valid query
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync type. If no
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync <em class="parameter"><code>type</code></em> argument is supplied,
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync <span><strong class="command">delv</strong></span> will perform a lookup for an
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync<dt><span class="term">-a <em class="replaceable"><code>anchor-file</code></em></span></dt>
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync Specifies a file from which to read DNSSEC trust anchors.
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync The default is <code class="filename">/etc/bind.keys</code>, which
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync is included with <acronym class="acronym">BIND</acronym> 9 and contains
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync trust anchors for the root zone (".") and for the ISC
ff78b877ed7acd25e2d384570a938441455d6a95vboxsync DNSSEC lookaside validation zone ("dlv.isc.org").
436b5c616e019c5e62053657c52d3ab5562ecbbfvboxsync Keys that do not match the root or DLV trust-anchor
3609dfc9f2733f4dc836c6a6bb3745398f280fcevboxsync names are ignored; these key names can be overridden
30868e719f5a45ec4689ecb2616767cb1fd02c28vboxsync Note: When reading the trust anchor file,
30868e719f5a45ec4689ecb2616767cb1fd02c28vboxsync <span><strong class="command">delv</strong></span> treats <code class="option">managed-keys</code>
30868e719f5a45ec4689ecb2616767cb1fd02c28vboxsync statements and <code class="option">trusted-keys</code> statements
30868e719f5a45ec4689ecb2616767cb1fd02c28vboxsync identically. That is, for a managed key, it is the
30868e719f5a45ec4689ecb2616767cb1fd02c28vboxsync <span class="emphasis"><em>initial</em></span> key that is trusted; RFC 5011
30868e719f5a45ec4689ecb2616767cb1fd02c28vboxsync key management is not supported. <span><strong class="command">delv</strong></span>
30868e719f5a45ec4689ecb2616767cb1fd02c28vboxsync will not consult the managed-keys database maintained by
30868e719f5a45ec4689ecb2616767cb1fd02c28vboxsync <span><strong class="command">named</strong></span>. This means that if either of the
30868e719f5a45ec4689ecb2616767cb1fd02c28vboxsync keys in <code class="filename">/etc/bind.keys</code> is revoked
30868e719f5a45ec4689ecb2616767cb1fd02c28vboxsync and rolled over, it will be necessary to update
30868e719f5a45ec4689ecb2616767cb1fd02c28vboxsync <code class="filename">/etc/bind.keys</code> to use DNSSEC
30868e719f5a45ec4689ecb2616767cb1fd02c28vboxsync validation in <span><strong class="command">delv</strong></span>.
30868e719f5a45ec4689ecb2616767cb1fd02c28vboxsync<dt><span class="term">-b <em class="replaceable"><code>address</code></em></span></dt>
c7a00ac75c7941df2afb62e6fd7ffdf1795e6c76vboxsync Sets the source IP address of the query to
c7a00ac75c7941df2afb62e6fd7ffdf1795e6c76vboxsync <em class="parameter"><code>address</code></em>. This must be a valid address
c7a00ac75c7941df2afb62e6fd7ffdf1795e6c76vboxsync on one of the host's network interfaces or "0.0.0.0" or "::".
30868e719f5a45ec4689ecb2616767cb1fd02c28vboxsync An optional source port may be specified by appending
30868e719f5a45ec4689ecb2616767cb1fd02c28vboxsync "#<port>"
30868e719f5a45ec4689ecb2616767cb1fd02c28vboxsync<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
3609dfc9f2733f4dc836c6a6bb3745398f280fcevboxsync Sets the query class for the requested data. Currently,
7c9a5eca233baf6ede345ace077a00bd0b7af1efvboxsync only class "IN" is supported in <span><strong class="command">delv</strong></span>
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync and any other value is ignored.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync<dt><span class="term">-d <em class="replaceable"><code>level</code></em></span></dt>
2508d15edddcae0b79002fae3fe103d6c4836810vboxsync Set the systemwide debug level to <code class="option">level</code>.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync The allowed range is from 0 to 99.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync The default is 0 (no debugging).
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync Debugging traces from <span><strong class="command">delv</strong></span> become
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync more verbose as the debug level increases.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync See the <code class="option">+mtrace</code>, <code class="option">+rtrace</code>,
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync and <code class="option">+vtrace</code> options below for additional
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync debugging details.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync Display the <span><strong class="command">delv</strong></span> help usage output and exit.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync Insecure mode. This disables internal DNSSEC validation.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync (Note, however, this does not set the CD bit on upstream
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync queries. If the server being queried is performing DNSSEC
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync validation, then it will not return invalid data; this
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync can cause <span><strong class="command">delv</strong></span> to time out. When it
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync is necessary to examine invalid data to debug a DNSSEC
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync problem, use <span><strong class="command">dig +cd</strong></span>.)
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync Enables memory usage debugging.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync<dt><span class="term">-p <em class="replaceable"><code>port#</code></em></span></dt>
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync Specifies a destination port to use for queries instead of
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync the standard DNS port number 53. This option would be used
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync with a name server that has been configured to listen
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync for queries on a non-standard port number.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync<dt><span class="term">-q <em class="replaceable"><code>name</code></em></span></dt>
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync Sets the query name to <em class="parameter"><code>name</code></em>.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync While the query name can be specified without using the
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync <code class="option">-q</code>, it is sometimes necessary to disambiguate
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync names from types or classes (for example, when looking up the
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync name "ns", which could be misinterpreted as the type NS,
2508d15edddcae0b79002fae3fe103d6c4836810vboxsync or "ch", which could be misinterpreted as class CH).
2508d15edddcae0b79002fae3fe103d6c4836810vboxsync<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync Sets the query type to <em class="parameter"><code>type</code></em>, which
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync can be any valid query type supported in BIND 9 except
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync for zone transfer types AXFR and IXFR. As with
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync <code class="option">-q</code>, this is useful to distinguish
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync query name type or class when they are ambiguous.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync it is sometimes necessary to disambiguate names from types.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync The default query type is "A", unless the <code class="option">-x</code>
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync option is supplied to indicate a reverse lookup, in which case
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync it is "PTR".
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync Print the <span><strong class="command">delv</strong></span> version and exit.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync<dt><span class="term">-x <em class="replaceable"><code>addr</code></em></span></dt>
2508d15edddcae0b79002fae3fe103d6c4836810vboxsync Performs a reverse lookup, mapping an addresses to
2508d15edddcae0b79002fae3fe103d6c4836810vboxsync a name. <em class="parameter"><code>addr</code></em> is an IPv4 address in
2508d15edddcae0b79002fae3fe103d6c4836810vboxsync dotted-decimal notation, or a colon-delimited IPv6 address.
2508d15edddcae0b79002fae3fe103d6c4836810vboxsync When <code class="option">-x</code> is used, there is no need to provide
2508d15edddcae0b79002fae3fe103d6c4836810vboxsync the <em class="parameter"><code>name</code></em> or <em class="parameter"><code>type</code></em>
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync arguments. <span><strong class="command">delv</strong></span> automatically performs a
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync lookup for a name like <code class="literal">11.12.13.10.in-addr.arpa</code>
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync and sets the query type to PTR. IPv6 addresses are looked up
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync using nibble format under the IP6.ARPA domain.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync Forces <span><strong class="command">delv</strong></span> to only use IPv4.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync Forces <span><strong class="command">delv</strong></span> to only use IPv6.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync<p><span><strong class="command">delv</strong></span>
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync provides a number of query options which affect the way results are
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync displayed, and in some cases the way lookups are performed.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync Each query option is identified by a keyword preceded by a plus sign
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync (<code class="literal">+</code>). Some keywords set or reset an
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync option. These may be preceded by the string
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync <code class="literal">no</code> to negate the meaning of that keyword.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync Other keywords assign values to options like the timeout interval.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync They have the form <code class="option">+keyword=value</code>.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync The query options are:
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync<dt><span class="term"><code class="option">+[no]cdflag</code></span></dt>
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync Controls whether to set the CD (checking disabled) bit in
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync queries sent by <span><strong class="command">delv</strong></span>. This may be useful
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync when troubleshooting DNSSEC problems from behind a validating
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync resolver. A validating resolver will block invalid responses,
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync making it difficult to retrieve them for analysis. Setting
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync the CD flag on queries will cause the resolver to return
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync invalid responses, which <span><strong class="command">delv</strong></span> can then
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync validate internally and report the errors in detail.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync<dt><span class="term"><code class="option">+[no]class</code></span></dt>
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync Controls whether to display the CLASS when printing
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync a record. The default is to display the CLASS.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync<dt><span class="term"><code class="option">+[no]ttl</code></span></dt>
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync Controls whether to display the TTL when printing
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync a record. The default is to display the TTL.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync<dt><span class="term"><code class="option">+[no]rtrace</code></span></dt>
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync Toggle resolver fetch logging. This reports the
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync name and type of each query sent by <span><strong class="command">delv</strong></span>
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync in the process of carrying out the resolution and validation
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync process: this includes including the original query and
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync all subsequent queries to follow CNAMEs and to establish a
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync chain of trust for DNSSEC validation.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync This is equivalent to setting the debug level to 1 in
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync the "resolver" logging category. Setting the systemwide
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync debug level to 1 using the <code class="option">-d</code> option will
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync product the same output (but will affect other logging
1999ae03c34840fa4d712fd2e020120b2cb7182avboxsync categories as well).
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync<dt><span class="term"><code class="option">+[no]mtrace</code></span></dt>
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync Toggle message logging. This produces a detailed dump of
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync the responses received by <span><strong class="command">delv</strong></span> in the
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync process of carrying out the resolution and validation process.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync This is equivalent to setting the debug level to 10
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync for the the "packets" module of the "resolver" logging
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync category. Setting the systemwide debug level to 10 using
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync the <code class="option">-d</code> option will produce the same output
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync (but will affect other logging categories as well).
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync<dt><span class="term"><code class="option">+[no]vtrace</code></span></dt>
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync Toggle validation logging. This shows the internal
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync process of the validator as it determines whether an
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync answer is validly signed, unsigned, or invalid.
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync This is equivalent to setting the debug level to 3
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync for the the "validator" module of the "dnssec" logging
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync category. Setting the systemwide debug level to 3 using
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync the <code class="option">-d</code> option will produce the same output
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync (but will affect other logging categories as well).
e2bd93b4f9c38c9b01eb960ba7bc1fc9c4d38ce8vboxsync<dt><span class="term"><code class="option">+[no]short</code></span></dt>
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync Provide a terse answer. The default is to print the answer in a
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync verbose form.
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync<dt><span class="term"><code class="option">+[no]comments</code></span></dt>
cc723cf07e365cd40b517b9c5da4f113e9469745vboxsync Toggle the display of comment lines in the output. The default
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync is to print comments.
cc723cf07e365cd40b517b9c5da4f113e9469745vboxsync<dt><span class="term"><code class="option">+[no]rrcomments</code></span></dt>
c7ff622115966b69b482bd2896662e40d823b22fvboxsync Toggle the display of per-record comments in the output (for
cc723cf07e365cd40b517b9c5da4f113e9469745vboxsync example, human-readable key information about DNSKEY records).
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync The default is to print per-record comments.
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync<dt><span class="term"><code class="option">+[no]crypto</code></span></dt>
42c1972c22e09797b4b24afbd0ec114ed076c37cvboxsync Toggle the display of cryptographic fields in DNSSEC records.
42c1972c22e09797b4b24afbd0ec114ed076c37cvboxsync The contents of these field are unnecessary to debug most DNSSEC
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync validation failures and removing them makes it easier to see
289060a0c3cb1d509f2cb01fca060796212376f6vboxsync the common failures. The default is to display the fields.
7c9a5eca233baf6ede345ace077a00bd0b7af1efvboxsync When omitted they are replaced by the string "[omitted]" or
7c9a5eca233baf6ede345ace077a00bd0b7af1efvboxsync in the DNSKEY case the key id is displayed as the replacement,
7c9a5eca233baf6ede345ace077a00bd0b7af1efvboxsync e.g. "[ key id = value ]".
3f1e0eea71cabeb90529e546f16eb7aee513fde9vboxsync<dt><span class="term"><code class="option">+[no]trust</code></span></dt>
3f1e0eea71cabeb90529e546f16eb7aee513fde9vboxsync Controls whether to display the trust level when printing
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync a record. The default is to display the trust level.
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync<dt><span class="term"><code class="option">+[no]split[=W]</code></span></dt>
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync Split long hex- or base64-formatted fields in resource
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync records into chunks of <em class="parameter"><code>W</code></em> characters
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync (where <em class="parameter"><code>W</code></em> is rounded up to the nearest
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync multiple of 4).
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync <em class="parameter"><code>+nosplit</code></em> or
1986f56777969a25707ab214f8dd070804be666cvboxsync <em class="parameter"><code>+split=0</code></em> causes fields not to be
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync split at all. The default is 56 characters, or 44 characters
1986f56777969a25707ab214f8dd070804be666cvboxsync when multiline mode is active.
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync<dt><span class="term"><code class="option">+[no]all</code></span></dt>
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync Set or clear the display options
1986f56777969a25707ab214f8dd070804be666cvboxsync<dt><span class="term"><code class="option">+[no]multiline</code></span></dt>
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync Print long records (such as RRSIG, DNSKEY, and SOA records)
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync in a verbose multi-line format with human-readable comments.
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync The default is to print each record on a single line, to
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync facilitate machine parsing of the <span><strong class="command">delv</strong></span>
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync<dt><span class="term"><code class="option">+[no]dnssec</code></span></dt>
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync Indicates whether to display RRSIG records in the
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync <span><strong class="command">delv</strong></span> output. The default is to
1986f56777969a25707ab214f8dd070804be666cvboxsync do so. Note that (unlike in <span><strong class="command">dig</strong></span>)
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync this does <span class="emphasis"><em>not</em></span> control whether to
1986f56777969a25707ab214f8dd070804be666cvboxsync request DNSSEC records or whether to validate them.
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync DNSSEC records are always requested, and validation
1986f56777969a25707ab214f8dd070804be666cvboxsync will always occur unless suppressed by the use of
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync <code class="option">-i</code> or <code class="option">+noroot</code> and
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync<dt><span class="term"><code class="option">+[no]root[=ROOT]</code></span></dt>
134a71c1528b56afe4db843ab63ec5a5b849535bvboxsync Indicates whether to perform conventional (non-lookaside)
7c9a5eca233baf6ede345ace077a00bd0b7af1efvboxsync DNSSEC validation, and if so, specifies the
7c9a5eca233baf6ede345ace077a00bd0b7af1efvboxsync name of a trust anchor. The default is to validate using
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync a trust anchor of "." (the root zone), for which there is
0bc7c910e57c78c68e89122e2244cc073d1ef06evboxsync a built-in key. If specifying a different trust anchor,
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync then <code class="option">-a</code> must be used to specify a file
611910c4ba57eb6db5c0d508ca7b923efd654aecvboxsync containing the key.
cc723cf07e365cd40b517b9c5da4f113e9469745vboxsync<dt><span class="term"><code class="option">+[no]dlv[=DLV]</code></span></dt>
7c9a5eca233baf6ede345ace077a00bd0b7af1efvboxsync Indicates whether to perform DNSSEC lookaside validation,
7c9a5eca233baf6ede345ace077a00bd0b7af1efvboxsync and if so, specifies the name of the DLV trust anchor.
cc723cf07e365cd40b517b9c5da4f113e9469745vboxsync The default is to perform lookaside validation using
7c9a5eca233baf6ede345ace077a00bd0b7af1efvboxsync a trust anchor of "dlv.isc.org", for which there is a
7c9a5eca233baf6ede345ace077a00bd0b7af1efvboxsync built-in key. If specifying a different name, then
7c9a5eca233baf6ede345ace077a00bd0b7af1efvboxsync <code class="option">-a</code> must be used to specify a file
cc723cf07e365cd40b517b9c5da4f113e9469745vboxsync containing the DLV key.
0bc7c910e57c78c68e89122e2244cc073d1ef06evboxsync<p><code class="filename">/etc/resolv.conf</code></p>
0bc7c910e57c78c68e89122e2244cc073d1ef06evboxsync<p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
7c9a5eca233baf6ede345ace077a00bd0b7af1efvboxsync <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
3c941112ffb137d71a8e457fcc3915f2d464ed2avboxsync<a accesskey="p" href="man.host.html">Prev</a>�</td>
42c1972c22e09797b4b24afbd0ec114ed076c37cvboxsync<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
1986f56777969a25707ab214f8dd070804be666cvboxsync<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-checkds.html">Next</a>
6f516ad9911d9037a18778742caa955fe362f8ffvboxsync<td width="40%" align="left" valign="top">host�</td>
cc723cf07e365cd40b517b9c5da4f113e9469745vboxsync<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
cc723cf07e365cd40b517b9c5da4f113e9469745vboxsync<td width="40%" align="right" valign="top">�<span class="application">dnssec-checkds</span>
cc723cf07e365cd40b517b9c5da4f113e9469745vboxsync<p style="text-align: center;">BIND 9.11.0pre-alpha</p>