man.dnssec-coverage.html revision 0f863f054cd14a83f8b8464d5976a97df39ee899
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek - Copyright (C) 2000-2016 Internet Systems Consortium, Inc. ("ISC")
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek - This Source Code Form is subject to the terms of the Mozilla Public
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek - License, v. 2.0. If a copy of the MPL was not distributed with this
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek - file, You can obtain one at http://mozilla.org/MPL/2.0/.
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek<link rel="prev" href="man.dnssec-checkds.html" title="dnssec-checkds">
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek<link rel="next" href="man.dnssec-dsfromkey.html" title="dnssec-dsfromkey">
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek<table width="100%" summary="Navigation header">
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek<tr><th colspan="3" align="center"><span class="application">dnssec-coverage</span></th></tr>
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek<a accesskey="p" href="man.dnssec-checkds.html">Prev</a>�</td>
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek<th width="60%" align="center">Manual pages</th>
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-dsfromkey.html">Next</a>
44703b84feaafa4f0a4f8df11c5a503dcf48616eJakub Hrozek<a name="man.dnssec-coverage"></a><div class="titlepage"></div>
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek <span class="application">dnssec-coverage</span>
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek — checks future DNSKEY coverage for a zone
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek [<code class="option">-l <em class="replaceable"><code>length</code></em></code>]
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek [<code class="option">-d <em class="replaceable"><code>DNSKEY TTL</code></em></code>]
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek [<code class="option">-m <em class="replaceable"><code>max TTL</code></em></code>]
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek [<code class="option">-r <em class="replaceable"><code>interval</code></em></code>]
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek [<code class="option">-c <em class="replaceable"><code>compilezone path</code></em></code>]
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek <p><span class="command"><strong>dnssec-coverage</strong></span>
4e5e846de22407f825fe3b4040d79606818a2419Jakub Hrozek verifies that the DNSSEC keys for a given zone or a set of zones
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek have timing metadata set properly to ensure no future lapses in DNSSEC
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek If <code class="option">zone</code> is specified, then keys found in
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek the key repository matching that zone are scanned, and an ordered
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek list is generated of the events scheduled for that key (i.e.,
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek publication, activation, inactivation, deletion). The list of
20a2be57d764f58c4a6532310331e26a3273ada8Lukas Slebodnik events is walked in order of occurrence. Warnings are generated
9c62d6619b87f1255ef6515280a20552fca9d925Lukas Slebodnik if any event is scheduled which could cause the zone to enter a
4e5e846de22407f825fe3b4040d79606818a2419Jakub Hrozek state in which validation failures might occur: for example, if
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek the number of published or active keys for a given algorithm drops
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek to zero, or if a key is deleted from the zone too soon after a new
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek key is rolled, and cached data signed by the prior key has not had
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek time to expire from resolver caches.
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek If <code class="option">zone</code> is not specified, then all keys in the
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek key repository will be scanned, and all zones for which there are
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek keys will be analyzed. (Note: This method of reporting is only
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek accurate if all the zones that have keys in a given repository
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek share the same TTL parameters.)
b4f87b42b18888c396e44e7359f7aafb092221bfJakub Hrozek <div class="variablelist"><dl class="variablelist">
b4f87b42b18888c396e44e7359f7aafb092221bfJakub Hrozek<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
b4f87b42b18888c396e44e7359f7aafb092221bfJakub Hrozek Sets the directory in which keys can be found. Defaults to the
b4f87b42b18888c396e44e7359f7aafb092221bfJakub Hrozek current working directory.
b4f87b42b18888c396e44e7359f7aafb092221bfJakub Hrozek<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
b4f87b42b18888c396e44e7359f7aafb092221bfJakub Hrozek If a <code class="option">file</code> is specified, then the zone is
b4f87b42b18888c396e44e7359f7aafb092221bfJakub Hrozek read from that file; the largest TTL and the DNSKEY TTL are
b4f87b42b18888c396e44e7359f7aafb092221bfJakub Hrozek determined directly from the zone data, and the
b4f87b42b18888c396e44e7359f7aafb092221bfJakub Hrozek <code class="option">-m</code> and <code class="option">-d</code> options do
b4f87b42b18888c396e44e7359f7aafb092221bfJakub Hrozek not need to be specified on the command line.
b4f87b42b18888c396e44e7359f7aafb092221bfJakub Hrozek<dt><span class="term">-l <em class="replaceable"><code>duration</code></em></span></dt>
b4f87b42b18888c396e44e7359f7aafb092221bfJakub Hrozek The length of time to check for DNSSEC coverage. Key events
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek scheduled further into the future than <code class="option">duration</code>
b4f87b42b18888c396e44e7359f7aafb092221bfJakub Hrozek will be ignored, and assumed to be correct.
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek The value of <code class="option">duration</code> can be set in seconds,
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek or in larger units of time by adding a suffix: 'mi' for minutes,
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek 'h' for hours, 'd' for days, 'w' for weeks, 'mo' for months,
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek 'y' for years.
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek<dt><span class="term">-m <em class="replaceable"><code>maximum TTL</code></em></span></dt>
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek Sets the value to be used as the maximum TTL for the zone or
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek zones being analyzed when determining whether there is a
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek possibility of validation failure. When a zone-signing key is
b4f87b42b18888c396e44e7359f7aafb092221bfJakub Hrozek deactivated, there must be enough time for the record in the
b4f87b42b18888c396e44e7359f7aafb092221bfJakub Hrozek zone with the longest TTL to have expired from resolver caches
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek before that key can be purged from the DNSKEY RRset. If that
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek condition does not apply, a warning will be generated.
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek The length of the TTL can be set in seconds, or in larger units
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek of time by adding a suffix: 'mi' for minutes, 'h' for hours,
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek This option is not necessary if the <code class="option">-f</code> has
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek been used to specify a zone file. If <code class="option">-f</code> has
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek been specified, this option may still be used; it will override
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek the value found in the file.
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek If this option is not used and the maximum TTL cannot be retrieved
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek from a zone file, a warning is generated and a default value of
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek 1 week is used.
b4f87b42b18888c396e44e7359f7aafb092221bfJakub Hrozek<dt><span class="term">-d <em class="replaceable"><code>DNSKEY TTL</code></em></span></dt>
b4f87b42b18888c396e44e7359f7aafb092221bfJakub Hrozek Sets the value to be used as the DNSKEY TTL for the zone or
b4f87b42b18888c396e44e7359f7aafb092221bfJakub Hrozek zones being analyzed when determining whether there is a
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek possibility of validation failure. When a key is rolled (that
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek is, replaced with a new key), there must be enough time for the
de8815aba87d08b6b7ac5d502dcb1755787e0857Jakub Hrozek old DNSKEY RRset to have expired from resolver caches before
de8815aba87d08b6b7ac5d502dcb1755787e0857Jakub Hrozek the new key is activated and begins generating signatures. If
de8815aba87d08b6b7ac5d502dcb1755787e0857Jakub Hrozek that condition does not apply, a warning will be generated.
de8815aba87d08b6b7ac5d502dcb1755787e0857Jakub Hrozek The length of the TTL can be set in seconds, or in larger units
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek of time by adding a suffix: 'mi' for minutes, 'h' for hours,
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek This option is not necessary if <code class="option">-f</code> has
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek been used to specify a zone file from which the TTL
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek of the DNSKEY RRset can be read, or if a default key TTL was
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek set using ith the <code class="option">-L</code> to
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek <span class="command"><strong>dnssec-keygen</strong></span>. If either of those is true,
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek this option may still be used; it will override the values
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek found in the zone file or the key file.
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek If this option is not used and the key TTL cannot be retrieved
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek from the zone file or the key file, then a warning is generated
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek and a default value of 1 day is used.
e00c2b5ac4963de9521599c88597b7fb97339d0eJakub Hrozek<dt><span class="term">-r <em class="replaceable"><code>resign interval</code></em></span></dt>
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek Sets the value to be used as the resign interval for the zone
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek or zones being analyzed when determining whether there is a
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek possibility of validation failure. This value defaults to
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek 22.5 days, which is also the default in
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek <span class="command"><strong>named</strong></span>. However, if it has been changed
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek by the <code class="option">sig-validity-interval</code> option in
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek <code class="filename">named.conf</code>, then it should also be
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek changed here.
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek The length of the interval can be set in seconds, or in larger
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek units of time by adding a suffix: 'mi' for minutes, 'h' for hours,
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
b5797517abb117cff7330acc894b71deda74be3dJakub Hrozek Only check KSK coverage; ignore ZSK events. Cannot be
44703b84feaafa4f0a4f8df11c5a503dcf48616eJakub Hrozek Only check ZSK coverage; ignore KSK events. Cannot be
44703b84feaafa4f0a4f8df11c5a503dcf48616eJakub Hrozek<dt><span class="term">-c <em class="replaceable"><code>compilezone path</code></em></span></dt>
44703b84feaafa4f0a4f8df11c5a503dcf48616eJakub Hrozek Specifies a path to a <span class="command"><strong>named-compilezone</strong></span> binary.
44703b84feaafa4f0a4f8df11c5a503dcf48616eJakub Hrozek Used for testing.
44703b84feaafa4f0a4f8df11c5a503dcf48616eJakub Hrozek <span class="refentrytitle">dnssec-checkds</span>(8)
44703b84feaafa4f0a4f8df11c5a503dcf48616eJakub Hrozek <span class="refentrytitle">dnssec-dsfromkey</span>(8)
44703b84feaafa4f0a4f8df11c5a503dcf48616eJakub Hrozek <span class="refentrytitle">dnssec-keygen</span>(8)
44703b84feaafa4f0a4f8df11c5a503dcf48616eJakub Hrozek <span class="refentrytitle">dnssec-signzone</span>(8)
44703b84feaafa4f0a4f8df11c5a503dcf48616eJakub Hrozek<table width="100%" summary="Navigation footer">
44703b84feaafa4f0a4f8df11c5a503dcf48616eJakub Hrozek<a accesskey="p" href="man.dnssec-checkds.html">Prev</a>�</td>
44703b84feaafa4f0a4f8df11c5a503dcf48616eJakub Hrozek<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
44703b84feaafa4f0a4f8df11c5a503dcf48616eJakub Hrozek<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-dsfromkey.html">Next</a>
44703b84feaafa4f0a4f8df11c5a503dcf48616eJakub Hrozek<span class="application">dnssec-checkds</span>�</td>
44703b84feaafa4f0a4f8df11c5a503dcf48616eJakub Hrozek<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
44703b84feaafa4f0a4f8df11c5a503dcf48616eJakub Hrozek<td width="40%" align="right" valign="top">�<span class="application">dnssec-dsfromkey</span>
44703b84feaafa4f0a4f8df11c5a503dcf48616eJakub Hrozek<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.1</p>