man.dnssec-coverage.html revision 1ebb25608fa10737ea27abd4e0481707ccd45581
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater - Copyright (C) 2004-2013 Internet Systems Consortium, Inc. ("ISC")
75c0816e8295e180f4bc7f10db3d0d880383bc1cMark Andrews - Copyright (C) 2000-2003 Internet Software Consortium.
4a14ce5ba00ab7bc55c99ffdcf59c7a4ab902721Automatic Updater - Permission to use, copy, modify, and/or distribute this software for any
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - purpose with or without fee is hereby granted, provided that the above
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - copyright notice and this permission notice appear in all copies.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - PERFORMANCE OF THIS SOFTWARE.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
e21a2904f02a03fa06b6db04d348f65fe9c67b2bMark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="prev" href="man.dnssec-checkds.html" title="dnssec-checkds">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="next" href="man.dnssec-dsfromkey.html" title="dnssec-dsfromkey">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<tr><th colspan="3" align="center"><span class="application">dnssec-coverage</span></th></tr>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a accesskey="p" href="man.dnssec-checkds.html">Prev</a>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-dsfromkey.html">Next</a>
ab8729140b1ad688ab03e1e9ce438fb1cbb49222Automatic Updater<a name="man.dnssec-coverage"></a><div class="titlepage"></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<p><span class="application">dnssec-coverage</span> — checks future DNSKEY coverage for a zone</p>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="cmdsynopsis"><p><code class="command">dnssec-coverage</code> [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>DNSKEY TTL</code></em></code>] [<code class="option">-m <em class="replaceable"><code>max TTL</code></em></code>] [<code class="option">-r <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-c <em class="replaceable"><code>compilezone path</code></em></code>] [zone]</p></div>
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater<p><span><strong class="command">dnssec-coverage</strong></span>
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater verifies that the DNSSEC keys for a given zone or a set of zones
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater have timing metadata set properly to ensure no future lapses in DNSSEC
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater If <code class="option">zone</code> is specified, then keys found in
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater the key repository matching that zone are scanned, and an ordered
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater list is generated of the events scheduled for that key (i.e.,
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater publication, activation, inactivation, deletion). The list of
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater events is walked in order of occurrence. Warnings are generated
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if any event is scheduled which could cause the zone to enter a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein state in which validation failures might occur: for example, if
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews the number of published or active keys for a given algorithm drops
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to zero, or if a key is deleted from the zone too soon after a new
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater key is rolled, and cached data signed by the prior key has not had
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater time to expire from resolver caches.
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater If <code class="option">zone</code> is not specified, then all keys in the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key repository will be scanned, and all zones for which there are
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein keys will be analyzed. (Note: This method of reporting is only
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein accurate if all the zones that have keys in a given repository
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein share the same TTL parameters.)
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater If a <code class="option">file</code> is specified, then the zone is
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater read from that file; the largest TTL and the DNSKEY TTL are
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein determined directly from the zone data, and the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="option">-m</code> and <code class="option">-d</code> options do
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein not need to be specified on the command line.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Sets the directory in which keys can be found. Defaults to the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein current working directory.
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater<dt><span class="term">-m <em class="replaceable"><code>maximum TTL</code></em></span></dt>
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater Sets the value to be used as the maximum TTL for the zone or
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater zones being analyzed when determining whether there is a
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater possibility of validation failure. When a zone-signing key is
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater deactivated, there must be enough time for the record in the
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater zone with the longest TTL to have expired from resolver caches
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater before that key can be purged from the DNSKEY RRset. If that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein condition does not apply, a warning will be generated.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The length of the TTL can be set in seconds, or in larger units
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of time by adding a suffix: 'mi' for minutes, 'h' for hours,
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This option is mandatory unless the <code class="option">-f</code> has
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater been used to specify a zone file. (If <code class="option">-f</code> has
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein been specified, this option may still be used; it will overrde
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater the value found in the file.)
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater<dt><span class="term">-d <em class="replaceable"><code>DNSKEY TTL</code></em></span></dt>
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater Sets the value to be used as the DNSKEY TTL for the zone or
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater zones being analyzed when determining whether there is a
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater possibility of validation failure. When a key is rolled (that
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater is, replaced with a new key), there must be enough time
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater for the old DNSKEY RRset to have expired from resolver caches
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater before the new key is activated and begins generating
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater signatures. If that condition does not apply, a warning
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater will be generated.
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater The length of the TTL can be set in seconds, or in larger units
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater of time by adding a suffix: 'mi' for minutes, 'h' for hours,
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater This option is mandatory unless the <code class="option">-f</code> has
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater been used to specify a zone file, or a default key TTL was
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater set with the <code class="option">-L</code> to
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater <span><strong class="command">dnssec-keygen</strong></span>. (If either of those is true,
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater this option may still be used; it will overrde the value found
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater in the zone or key file.)
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater<dt><span class="term">-r <em class="replaceable"><code>resign interval</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Sets the value to be used as the resign interval for the zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein or zones being analyzed when determining whether there is a
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews possibility of validation failure. This value defaults to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 22.5 days, which is also the default in
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater <span><strong class="command">named</strong></span>. However, if it has been changed
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein by the <code class="option">sig-validity-interval</code> option in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">named.conf</code>, then it should also be
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews changed here.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The length of the interval can be set in seconds, or in larger
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein units of time by adding a suffix: 'mi' for minutes, 'h' for hours,
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-c <em class="replaceable"><code>compilezone path</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Specifies a path to a <span><strong class="command">named-compilezone</strong></span> binary.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Used for testing.
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater <span class="citerefentry"><span class="refentrytitle">dnssec-checkds</span>(8)</span>,
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater <span class="citerefentry"><span class="refentrytitle">dnssec-dsfromkey</span>(8)</span>,
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater<p><span class="corpauthor">Internet Systems Consortium</span>
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater<a accesskey="p" href="man.dnssec-checkds.html">Prev</a>�</td>
a1ad6695ed6f988406cf155aa26376f84f73bcb9Automatic Updater<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-dsfromkey.html">Next</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<span class="application">dnssec-checkds</span>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater<td width="40%" align="right" valign="top">�<span class="application">dnssec-dsfromkey</span>