man.delv.html revision f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe - Copyright (C) 2000-2003 Internet Software Consortium.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe - Permission to use, copy, modify, and/or distribute this software for any
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe - purpose with or without fee is hereby granted, provided that the above
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe - copyright notice and this permission notice appear in all copies.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe - PERFORMANCE OF THIS SOFTWARE.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<!-- $Id$ -->
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
0066eddda7203f6345b56f77d146a759298dc635gryzor<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<link rel="next" href="man.dnssec-checkds.html" title="dnssec-checkds">
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-checkds.html">Next</a>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<div class="cmdsynopsis"><p><code class="command">delv</code> [@server] [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-a <em class="replaceable"><code>anchor-file</code></em></code>] [<code class="option">-b <em class="replaceable"><code>address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>level</code></em></code>] [<code class="option">-i</code>] [<code class="option">-m</code>] [<code class="option">-p <em class="replaceable"><code>port#</code></em></code>] [<code class="option">-q <em class="replaceable"><code>name</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-x <em class="replaceable"><code>addr</code></em></code>] [name] [type] [class] [queryopt...]</p></div>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<div class="cmdsynopsis"><p><code class="command">delv</code> [<code class="option">-h</code>]</p></div>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<div class="cmdsynopsis"><p><code class="command">delv</code> [<code class="option">-v</code>]</p></div>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<div class="cmdsynopsis"><p><code class="command">delv</code> [queryopt...] [query...]</p></div>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe (Domain Entity Lookup & Validation) is a tool for sending
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe DNS queries and validating the results, using the the same internal
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe resolver and validator logic as <span><strong class="command">named</strong></span>.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <span><strong class="command">delv</strong></span> will send to a specified name server all
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe queries needed to fetch and validate the requested data; this
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe includes the original requested query, subsequent queries to follow
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe CNAME or DNAME chains, and queries for DNSKEY, DS and DLV records
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe to establish a chain of trust for DNSSEC validation.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe It does not perform iterative resolution, but simulates the
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe behavior of a name server configured for DNSSEC validating and
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe forwarding.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe By default, responses are validated using built-in DNSSEC trust
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe anchors for the root zone (".") and for the ISC DNSSEC lookaside
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe validation zone ("dlv.isc.org"). Records returned by
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <span><strong class="command">delv</strong></span> are either fully validated or
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe were not signed. If validation fails, an explanation of
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe the failure is included in the output; the validation process
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe can be traced in detail. Because <span><strong class="command">delv</strong></span> does
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe not rely on an external server to carry out validation, it can
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe be used to check the validity of DNS responses in environments
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe where local name servers may not be trustworthy.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe Unless it is told to query a specific name server,
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <span><strong class="command">delv</strong></span> will try each of the servers listed in
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <code class="filename">/etc/resolv.conf</code>. If no usable server
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe addresses are found, <span><strong class="command">delv</strong></span> will send
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe queries to the localhost addresses (127.0.0.1 for IPv4, ::1
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe When no command line arguments or options are given,
27dcd8d81085fd60aadcd8a9bad35a607b26b758nilgun <span><strong class="command">delv</strong></span> will perform an NS query for "."
27dcd8d81085fd60aadcd8a9bad35a607b26b758nilgun (the root zone).
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe A typical invocation of <span><strong class="command">delv</strong></span> looks like:
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<pre class="programlisting"> delv @server name type </pre>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<dt><span class="term"><code class="constant">server</code></span></dt>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe is the name or IP address of the name server to query. This
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe can be an IPv4 address in dotted-decimal notation or an IPv6
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe address in colon-delimited notation. When the supplied
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <em class="parameter"><code>server</code></em> argument is a hostname,
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <span><strong class="command">delv</strong></span> resolves that name before
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe querying that name server (note, however, that this
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe initial lookup is <span class="emphasis"><em>not</em></span> validated
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe by DNSSEC).
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe If no <em class="parameter"><code>server</code></em> argument is
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe provided, <span><strong class="command">delv</strong></span> consults
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe address is found there, it queries the name server at
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe that address. If either of the <code class="option">-4</code> or
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <code class="option">-6</code> options are in use, then
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe only addresses for the corresponding transport
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe will be tried. If no usable addresses are found,
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <span><strong class="command">delv</strong></span> will send queries to
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe the localhost addresses (127.0.0.1 for IPv4,
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe ::1 for IPv6).
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<dt><span class="term"><code class="constant">name</code></span></dt>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe is the domain name to be looked up.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<dt><span class="term"><code class="constant">type</code></span></dt>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe indicates what type of query is required —
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe ANY, A, MX, etc.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <em class="parameter"><code>type</code></em> can be any valid query
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe type. If no
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <em class="parameter"><code>type</code></em> argument is supplied,
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <span><strong class="command">delv</strong></span> will perform a lookup for an
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<dt><span class="term">-a <em class="replaceable"><code>anchor-file</code></em></span></dt>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe Specifies a file from which to read DNSSEC trust anchors.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe The default is <code class="filename">/etc/bind.keys</code>, which
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe is included with <acronym class="acronym">BIND</acronym> 9 and contains
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe trust anchors for the root zone (".") and for the ISC
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe DNSSEC lookaside validation zone ("dlv.isc.org").
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe Keys that do not match the root or DLV trust-anchor
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe names are ignored; these key names can be overridden
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe Note: When reading the trust anchor file,
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <span><strong class="command">delv</strong></span> treats <code class="option">managed-keys</code>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe statements and <code class="option">trusted-keys</code> statements
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe identically. That is, for a managed key, it is the
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <span class="emphasis"><em>initial</em></span> key that is trusted; RFC 5011
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe key management is not supported. <span><strong class="command">delv</strong></span>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe will not consult the managed-keys database maintained by
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <span><strong class="command">named</strong></span>. This means that if either of the
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe keys in <code class="filename">/etc/bind.keys</code> is revoked
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe and rolled over, it will be necessary to update
27dcd8d81085fd60aadcd8a9bad35a607b26b758nilgun <code class="filename">/etc/bind.keys</code> to use DNSSEC
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe validation in <span><strong class="command">delv</strong></span>.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<dt><span class="term">-b <em class="replaceable"><code>address</code></em></span></dt>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe Sets the source IP address of the query to
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <em class="parameter"><code>address</code></em>. This must be a valid address
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe on one of the host's network interfaces or "0.0.0.0" or "::".
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe An optional source port may be specified by appending
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe "#<port>"
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe Sets the query class for the requested data. Currently,
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe only class "IN" is supported in <span><strong class="command">delv</strong></span>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe and any other value is ignored.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<dt><span class="term">-d <em class="replaceable"><code>level</code></em></span></dt>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe Set the systemwide debug level to <code class="option">level</code>.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe The allowed range is from 0 to 99.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe The default is 0 (no debugging).
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe Debugging traces from <span><strong class="command">delv</strong></span> become
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe more verbose as the debug level increases.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe See the <code class="option">+mtrace</code>, <code class="option">+rtrace</code>,
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe and <code class="option">+vtrace</code> options below for additional
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe debugging details.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe Display the <span><strong class="command">delv</strong></span> help usage output and exit.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe Insecure mode. This disables internal DNSSEC validation.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe (Note, however, this does not set the CD bit on upstream
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe queries. If the server being queried is performing DNSSEC
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe validation, then it will not return invalid data; this
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe can cause <span><strong class="command">delv</strong></span> to time out. When it
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe is necessary to examine invalid data to debug a DNSSEC
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe problem, use <span><strong class="command">dig +cd</strong></span>.)
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe Enables memory usage debugging.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<dt><span class="term">-p <em class="replaceable"><code>port#</code></em></span></dt>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe Specifies a destination port to use for queries instead of
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe the standard DNS port number 53. This option would be used
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe with a name server that has been configured to listen
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe for queries on a non-standard port number.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<dt><span class="term">-q <em class="replaceable"><code>name</code></em></span></dt>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe Sets the query name to <em class="parameter"><code>name</code></em>.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe While the query name can be specified without using the
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <code class="option">-q</code>, it is sometimes necessary to disambiguate
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe names from types or classes (for example, when looking up the
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe name "ns", which could be misinterpreted as the type NS,
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe or "ch", which could be misinterpreted as class CH).
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe Sets the query type to <em class="parameter"><code>type</code></em>, which
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe can be any valid query type supported in BIND 9 except
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe for zone transfer types AXFR and IXFR. As with
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <code class="option">-q</code>, this is useful to distinguish
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe query name type or class when they are ambiguous.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe it is sometimes necessary to disambiguate names from types.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe The default query type is "A", unless the <code class="option">-x</code>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe option is supplied to indicate a reverse lookup, in which case
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe it is "PTR".
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe Print the <span><strong class="command">delv</strong></span> version and exit.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<dt><span class="term">-x <em class="replaceable"><code>addr</code></em></span></dt>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe Performs a reverse lookup, mapping an addresses to
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe a name. <em class="parameter"><code>addr</code></em> is an IPv4 address in
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe dotted-decimal notation, or a colon-delimited IPv6 address.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe When <code class="option">-x</code> is used, there is no need to provide
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe the <em class="parameter"><code>name</code></em> or <em class="parameter"><code>type</code></em>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe arguments. <span><strong class="command">delv</strong></span> automatically performs a
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe lookup for a name like <code class="literal">11.12.13.10.in-addr.arpa</code>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe and sets the query type to PTR. IPv6 addresses are looked up
0066eddda7203f6345b56f77d146a759298dc635gryzor using nibble format under the IP6.ARPA domain.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe Forces <span><strong class="command">delv</strong></span> to only use IPv4.
e.g. "[ key id = value ]".
a trust anchor of "dlv.isc.org", for which there is a