3853N/A - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC") 3853N/A - Copyright (C) 2000-2003 Internet Software Consortium. 3853N/A - Permission to use, copy, modify, and/or distribute this software for any 3853N/A - purpose with or without fee is hereby granted, provided that the above 3853N/A - copyright notice and this permission notice appear in all copies. 3853N/A - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 3853N/A - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 3853N/A - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 3853N/A - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 3853N/A - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 3853N/A - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 3853N/A - PERFORMANCE OF THIS SOFTWARE. 3853N/A<
meta http-
equiv="Content-Type" content="text/html; charset=ISO-8859-1">
3853N/A<
meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
3853N/A<
link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
3853N/A<
body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
4129N/A<
table width="100%" summary="Navigation header">
4129N/A<
tr><
th colspan="3" align="center">delve</
th></
tr>
3853N/A<
td width="20%" align="left">
3853N/A<
th width="60%" align="center">Manual pages</
th>
4129N/A<
div class="refentry" lang="en">
4129N/A<
p>delve — DNS lookup and validation utility</
p>
3853N/A<
div class="refsynopsisdiv">
3853N/A<
div class="cmdsynopsis"><
p><
code class="command">delve</
code> [@server] [<
code class="option">-4</
code>] [<
code class="option">-6</
code>] [<
code class="option">-a <
em class="replaceable"><
code>anchor-file</
code></
em></
code>] [<
code class="option">-b <
em class="replaceable"><
code>address</
code></
em></
code>] [<
code class="option">-c <
em class="replaceable"><
code>class</
code></
em></
code>] [<
code class="option">-d <
em class="replaceable"><
code>level</
code></
em></
code>] [<
code class="option">-i</
code>] [<
code class="option">-m</
code>] [<
code class="option">-p <
em class="replaceable"><
code>port#</
code></
em></
code>] [<
code class="option">-q <
em class="replaceable"><
code>name</
code></
em></
code>] [<
code class="option">-t <
em class="replaceable"><
code>type</
code></
em></
code>] [<
code class="option">-x <
em class="replaceable"><
code>addr</
code></
em></
code>] [name] [type] [class] [queryopt...]</
p></
div>
4129N/A<
div class="cmdsynopsis"><
p><
code class="command">delve</
code> [<
code class="option">-h</
code>]</
p></
div>
3853N/A<
div class="cmdsynopsis"><
p><
code class="command">delve</
code> [queryopt...] [query...]</
p></
div>
3853N/A<
div class="refsect1" lang="en">
4129N/A<
a name="id2614505"></
a><
h2>DESCRIPTION</
h2>
4129N/A<
p><
span><
strong class="command">delve</
strong></
span>
3853N/A (Domain Entity Lookup & Validation Engine) is a tool for sending
4129N/A DNS queries and validating the results, using the the same internal
4129N/A resolver and validator logic as <
span><
strong class="command">named</
strong></
span>.
3853N/A <
span><
strong class="command">delve</
strong></
span> will send to a specified name server all
4129N/A queries needed to fetch and validate the requested data; this
3853N/A includes the original requested query, subsequent queries to follow
4129N/A CNAME or DNAME chains, and queries for DNSKEY, DS and DLV records
4129N/A to establish a chain of trust for DNSSEC validation.
4129N/A It does not perform iterative resolution, but simulates the
4129N/A behavior of a name server configured for DNSSEC validating and
4129N/A By default, responses are validated using built-in DNSSEC trust
4129N/A anchors for the root zone (".") and for the ISC DNSSEC lookaside
4129N/A <
span><
strong class="command">delve</
strong></
span> are either fully validated or
4129N/A were not signed. If validation fails, an explanation of
4129N/A the failure is included in the output; the validation process
3853N/A can be traced in detail. Because <
span><
strong class="command">delve</
strong></
span> does
4129N/A not rely on an external server to carry out validation, it can
4129N/A be used to check the validity of DNS responses in environments
3853N/A where local name servers may not be trustworthy.
4129N/A Unless it is told to query a specific name server,
4129N/A <
span><
strong class="command">delve</
strong></
span> will try each of the servers listed in
3853N/A addresses are found, <
span><
strong class="command">delve</
strong></
span> will send
4129N/A queries to the localhost addresses (127.0.0.1 for IPv4, ::1
4129N/A When no command line arguments or options are given,
4129N/A <
span><
strong class="command">delve</
strong></
span> will perform an NS query for "."
4129N/A<
div class="refsect1" lang="en">
3853N/A<
a name="id2614578"></
a><
h2>SIMPLE USAGE</
h2>
3970N/A A typical invocation of <
span><
strong class="command">delve</
strong></
span> looks like:
4129N/A<
pre class="programlisting"> delve @server name type </
pre>
3970N/A<
div class="variablelist"><
dl>
4129N/A<
dt><
span class="term"><
code class="constant">server</
code></
span></
dt>
4129N/A is the name or IP address of the name server to query. This
4129N/A can be an IPv4 address in dotted-decimal notation or an IPv6
4129N/A address in colon-delimited notation. When the supplied
3853N/A <
em class="parameter"><
code>server</
code></
em> argument is a hostname,
4129N/A <
span><
strong class="command">delve</
strong></
span> resolves that name before
4129N/A querying that name server (note, however, that this
3853N/A initial lookup is <
span class="emphasis"><
em>not</
em></
span> validated
4129N/A If no <
em class="parameter"><
code>server</
code></
em> argument is
4129N/A provided, <
span><
strong class="command">delve</
strong></
span> consults
4129N/A address is found there, it queries the name server at
4129N/A that address. If either of the <
code class="option">-4</
code> or
3853N/A <
code class="option">-6</
code> options are in use, then
4129N/A only addresses for the corresponding transport
4129N/A will be tried. If no usable addresses are found,
4129N/A <
span><
strong class="command">delve</
strong></
span> will send queries to
4129N/A the localhost addresses (127.0.0.1 for IPv4,
5237N/A<
dt><
span class="term"><
code class="constant">name</
code></
span></
dt>
5237N/A is the domain name to be looked up.
5237N/A<
dt><
span class="term"><
code class="constant">type</
code></
span></
dt>
5237N/A indicates what type of query is required —
4129N/A <
em class="parameter"><
code>type</
code></
em> can be any valid query
4129N/A <
em class="parameter"><
code>type</
code></
em> argument is supplied,
4129N/A <
span><
strong class="command">delve</
strong></
span> will perform a lookup for an
4129N/A<
div class="refsect1" lang="en">
4129N/A<
a name="id2614914"></
a><
h2>OPTIONS</
h2>
4129N/A<
div class="variablelist"><
dl>
4129N/A<
dt><
span class="term">-a</
span></
dt>
4129N/A Specifies a file from which to read DNSSEC trust anchors.
4129N/A is included with <
acronym class="acronym">BIND</
acronym> 9 and contains
4129N/A trust anchors for the root zone (".") and for the ISC
3853N/A Keys that do not match the root or DLV trust-anchor
4129N/A names are ignored; these key names can be overridden
4129N/A using the <
code class="option">+dlv=NAME</
code> or
4129N/A <
code class="option">+root=NAME</
code> options.
4129N/A Note: When reading the trust anchor file,
4129N/A <
span><
strong class="command">delve</
strong></
span> treats <
code class="option">managed-keys</
code>
4129N/A statements and <
code class="option">trusted-keys</
code> statements
3853N/A identically. That is, for a managed key, it is the
3853N/A <
span class="emphasis"><
em>initial</
em></
span> key that is trusted; RFC 5011
3853N/A key management is not supported. <
span><
strong class="command">delve</
strong></
span>
3853N/A will not consult the managed-keys database maintained by
4129N/A <
span><
strong class="command">named</
strong></
span>. This means that if either of the
4129N/A and rolled over, it will be necessary to update
4129N/A validation in <
span><
strong class="command">delve</
strong></
span>.
4129N/A<
dt><
span class="term">-b</
span></
dt>
3853N/A Sets the source IP address of the query to
3853N/A <
em class="parameter"><
code>address</
code></
em>. This must be a valid address
4129N/A on one of the host's network interfaces or "0.0.0.0" or "::".
4129N/A An optional source port may be specified by appending
4129N/A<
dt><
span class="term">-c</
span></
dt>
4129N/A Sets the query class for the requested data. Currently,
4129N/A only class "IN" is supported in <
span><
strong class="command">delve</
strong></
span>
4129N/A and any other value is ignored.
4129N/A<
dt><
span class="term">-i</
span></
dt>
4129N/A Insecure mode. This disables internal DNSSEC validation.
4129N/A (Note, however, this does not set the CD bit on upstream
4129N/A queries. If the server being queried is performing DNSSEC
4129N/A validation, then it will not return invalid data; this
4129N/A can cause <
span><
strong class="command">delve</
strong></
span> to time out. When it
4129N/A is necessary to examine invalid data to debug a DNSSEC
4129N/A problem, use <
span><
strong class="command">dig +cd</
strong></
span>.)
4129N/A<
dt><
span class="term">-m</
span></
dt>
4129N/A Enables memory usage debugging.
4129N/A<
dt><
span class="term">-p</
span></
dt>
4129N/A Specifies a destination port to use for queries instead of
4129N/A the standard DNS port number 53. This option would be used
4129N/A with a name server that has been configured to listen
4129N/A for queries on a non-standard port number.
3853N/A<
dt><
span class="term">-4</
span></
dt>
4129N/A Forces <
span><
strong class="command">delve</
strong></
span> to only use IPv4.
4129N/A<
dt><
span class="term">-6</
span></
dt>
4129N/A Forces <
span><
strong class="command">delve</
strong></
span> to only use IPv6.
4129N/A<
dt><
span class="term">-q</
span></
dt>
4129N/A Sets the query name to <
em class="parameter"><
code>name</
code></
em>.
4129N/A While the query name can be specified without using the
4129N/A <
code class="option">-q</
code>, it is sometimes necessary to disambiguate
4129N/A names from types or classes (for example, when looking up the
4129N/A name "ns", which could be misinterpreted as the type NS,
4129N/A or "ch", which could be misinterpreted as class CH).
4129N/A<
dt><
span class="term">-t</
span></
dt>
4129N/A Sets the query type to <
em class="parameter"><
code>type</
code></
em>, which
4129N/A can be any valid query type supported in BIND 9 except
4129N/A for zone transfer types AXFR and IXFR. As with
4129N/A <
code class="option">-q</
code>, this is useful to distinguish
4129N/A query name type or class when they are ambiguous.
4129N/A it is sometimes necessary to disambiguate names from types.
4129N/A The default query type is "A", unless the <
code class="option">-x</
code>
4129N/A option is supplied to indicate a reverse lookup, in which case
4129N/A<
dt><
span class="term">-x</
span></
dt>
4129N/A Performs a reverse lookup, mapping an addresses to
4129N/A a name. <
em class="parameter"><
code>addr</
code></
em> is an IPv4 address in
4129N/A dotted-decimal notation, or a colon-delimited IPv6 address.
4129N/A When <
code class="option">-x</
code> is used, there is no need to provide
4129N/A the <
em class="parameter"><
code>name</
code></
em> or <
em class="parameter"><
code>type</
code></
em>
4129N/A arguments. <
span><
strong class="command">delve</
strong></
span> automatically performs a
4129N/A and sets the query type to PTR. IPv6 addresses are looked up
4129N/A<
div class="refsect1" lang="en">
4129N/A<
a name="id2670450"></
a><
h2>QUERY OPTIONS</
h2>
4129N/A<
p><
span><
strong class="command">delve</
strong></
span>
4129N/A provides a number of query options which affect the way results are
4129N/A displayed, and in some cases the way lookups are performed.
4129N/A Each query option is identified by a keyword preceded by a plus sign
4129N/A (<
code class="literal">+</
code>). Some keywords set or reset an
4129N/A option. These may be preceded by the string
4129N/A <
code class="literal">no</
code> to negate the meaning of that keyword.
4129N/A Other keywords assign values to options like the timeout interval.
4129N/A They have the form <
code class="option">+keyword=value</
code>.
4129N/A<
div class="variablelist"><
dl>
4129N/A<
dt><
span class="term"><
code class="option">+[no]cdflag</
code></
span></
dt>
4129N/A Controls whether to set the CD (checking disabled) bit in
4129N/A queries sent by <
span><
strong class="command">delve</
strong></
span>. This may be useful
4129N/A when troubleshooting DNSSEC problems from behind a validating
4129N/A resolver. A validating resolver will block invalid responses,
4129N/A making it difficult to retrieve them for analysis. Setting
4129N/A the CD flag on queries will cause the resolver to return
4129N/A invalid responses, which <
span><
strong class="command">delve</
strong></
span> can then
4129N/A validate internally and report the errors in detail.
4129N/A<
dt><
span class="term"><
code class="option">+[no]class</
code></
span></
dt>
3853N/A Controls whether to display the CLASS when printing
3853N/A a record. The default is to display the CLASS.
4129N/A<
dt><
span class="term"><
code class="option">+[no]ttl</
code></
span></
dt>
4129N/A Controls whether to display the TTL when printing
4129N/A a record. The default is to display the TTL.
4129N/A<
dt><
span class="term"><
code class="option">+[no]rtrace</
code></
span></
dt>
4129N/A Toggle resolver fetch logging. This reports the
4129N/A name and type of each query sent by <
span><
strong class="command">delve</
strong></
span>
4129N/A in the process of carrying out the resolution and validation
4129N/A process: this includes including the original query and
4129N/A all subsequent queries to follow CNAMEs and to establish a
4129N/A chain of trust for DNSSEC validation.
5237N/A This is equivalent to setting the debug level to 1 in
5237N/A the "resolver" logging category. Setting the systemwide
5237N/A debug level to 1 using the <
code class="option">-d</
code> option will
5237N/A product the same output (but will affect other logging
5237N/A<
dt><
span class="term"><
code class="option">+[no]mtrace</
code></
span></
dt>
5237N/A Toggle message logging. This produces a detailed dump of
5237N/A the responses received by <
span><
strong class="command">delve</
strong></
span> in the
5237N/A process of carrying out the resolution and validation process.
5237N/A This is equivalent to setting the debug level to 10
5237N/A for the the "packets" module of the "resolver" logging
5237N/A category. Setting the systemwide debug level to 10 using
5237N/A the <
code class="option">-d</
code> option will produce the same output
5237N/A (but will affect other logging categories as well).
4129N/A<
dt><
span class="term"><
code class="option">+[no]vtrace</
code></
span></
dt>
4129N/A Toggle validation logging. This shows the internal
4129N/A process of the validator as it determines whether an
4129N/A answer is validly signed, unsigned, or invalid.
4129N/A This is equivalent to setting the debug level to 3
4129N/A for the the "validator" module of the "dnssec" logging
4129N/A category. Setting the systemwide debug level to 3 using
4129N/A the <
code class="option">-d</
code> option will produce the same output
4129N/A (but will affect other logging categories as well).
4129N/A<
dt><
span class="term"><
code class="option">+[no]short</
code></
span></
dt>
4129N/A Provide a terse answer. The default is to print the answer in a
4129N/A<
dt><
span class="term"><
code class="option">+[no]comments</
code></
span></
dt>
4129N/A Toggle the display of comment lines in the output. The default
4129N/A<
dt><
span class="term"><
code class="option">+[no]rrcomments</
code></
span></
dt>
4129N/A Toggle the display of per-record comments in the output (for
4129N/A example, human-readable key information about DNSKEY records).
4129N/A The default is to print per-record comments.
4129N/A<
dt><
span class="term"><
code class="option">+[no]crypto</
code></
span></
dt>
3853N/A Toggle the display of cryptographic fields in DNSSEC records.
4129N/A The contents of these field are unnecessary to debug most DNSSEC
4129N/A validation failures and removing them makes it easier to see
3853N/A the common failures. The default is to display the fields.
4129N/A When omitted they are replaced by the string "[omitted]" or
4129N/A in the DNSKEY case the key id is displayed as the replacement,
4129N/A<
dt><
span class="term"><
code class="option">+[no]trust</
code></
span></
dt>
4129N/A Controls whether to display the trust level when printing
4129N/A a record. The default is to display the trust level.
4129N/A<
dt><
span class="term"><
code class="option">+[no]split[=W]</
code></
span></
dt>
4129N/A Split long hex- or base64-formatted fields in resource
4129N/A records into chunks of <
em class="parameter"><
code>W</
code></
em> characters
4129N/A (where <
em class="parameter"><
code>W</
code></
em> is rounded up to the nearest
4129N/A <
em class="parameter"><
code>+nosplit</
code></
em> or
4129N/A <
em class="parameter"><
code>+split=0</
code></
em> causes fields not to be
3853N/A split at all. The default is 56 characters, or 44 characters
3853N/A when multiline mode is active.
4129N/A<
dt><
span class="term"><
code class="option">+[no]all</
code></
span></
dt>
4129N/A Set or clear the display options
4129N/A <
code class="option">+[no]comments</
code>,
4129N/A <
code class="option">+[no]rrcomments</
code>, and
4129N/A <
code class="option">+[no]trust</
code> as a group.
3853N/A<
dt><
span class="term"><
code class="option">+[no]multiline</
code></
span></
dt>
3853N/A Print long records (such as RRSIG, DNSKEY, and SOA records)
3853N/A in a verbose multi-line format with human-readable comments.
3853N/A The default is to print each record on a single line, to
3853N/A facilitate machine parsing of the <
span><
strong class="command">delve</
strong></
span>
3853N/A<
dt><
span class="term"><
code class="option">+[no]dnssec</
code></
span></
dt>
4129N/A Indicates whether to display RRSIG records in the
4129N/A <
span><
strong class="command">delve</
strong></
span> output. The default is to
4134N/A do so. Note that (unlike in <
span><
strong class="command">dig</
strong></
span>)
3853N/A this does <
span class="emphasis"><
em>not</
em></
span> control whether to
4129N/A request DNSSEC records or whether to validate them.
4129N/A DNSSEC records are always requested, and validation
4129N/A will always occur unless suppressed by the use of
4129N/A <
code class="option">-i</
code> or <
code class="option">+noroot</
code> and
4129N/A <
code class="option">+nodlv</
code>.
4134N/A<
dt><
span class="term"><
code class="option">+[no]root[=ROOT]</
code></
span></
dt>
3853N/A Indicates whether to perform conventional (non-
3853N/A lookaside) DNSSEC validation, and if so, specifies the
4129N/A name of a trust anchor. The default is to validate using
4129N/A a trust anchor of "." (the root zone), for which there is
4134N/A a built-in key. If specifying a different trust anchor,
3853N/A then <
code class="option">-a</
code> must be used to specify a file
3853N/A<
dt><
span class="term"><
code class="option">+[no]dlv[=DLV]</
code></
span></
dt>
4129N/A Indicates whether to perform DNSSEC lookaside validation,
4129N/A and if so, specifies the name of the DLV trust anchor.
4129N/A The default is to perform lookaside validation using
4129N/A built-in key. If specifying a different name, then
4129N/A <
code class="option">-a</
code> must be used to specify a file
4129N/A<
div class="refsect1" lang="en">
4129N/A<
a name="id2670966"></
a><
h2>FILES</
h2>
4129N/A<
div class="refsect1" lang="en">
4129N/A<
a name="id2670985"></
a><
h2>SEE ALSO</
h2>
4129N/A<
p><
span class="citerefentry"><
span class="refentrytitle">dig</
span>(1)</
span>,
4129N/A <
span class="citerefentry"><
span class="refentrytitle">named</
span>(8)</
span>,
4129N/A <
em class="citetitle">RFC4034</
em>,
4129N/A <
em class="citetitle">RFC4035</
em>,
4129N/A <
em class="citetitle">RFC4431</
em>,
4129N/A <
em class="citetitle">RFC5074</
em>,
4129N/A <
em class="citetitle">RFC5155</
em>.
4129N/A<
table width="100%" summary="Navigation footer">
4129N/A<
td width="40%" align="left">
5237N/A<
td width="40%" align="left" valign="top">host�</
td>
5237N/A<
td width="40%" align="right" valign="top">�<
span class="application">dnssec-checkds</
span>