man.dnssec-coverage.html revision 350e5eecadfc5ee72b11b2cc46828c9a0bcd717c
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync - Copyright (C) 2000-2017 Internet Systems Consortium, Inc. ("ISC")
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync - This Source Code Form is subject to the terms of the Mozilla Public
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync - License, v. 2.0. If a copy of the MPL was not distributed with this
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync - file, You can obtain one at http://mozilla.org/MPL/2.0/.
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync<link rel="prev" href="man.dnssec-checkds.html" title="dnssec-checkds">
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync<link rel="next" href="man.dnssec-dsfromkey.html" title="dnssec-dsfromkey">
2609df5222cfcceb51ec536b2e3173b7227a232avboxsync<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
ddd5bf03356cc0515b0f42ed9048a6364e7eb1e2vboxsync<tr><th colspan="3" align="center"><span class="application">dnssec-coverage</span></th></tr>
2609df5222cfcceb51ec536b2e3173b7227a232avboxsync<a accesskey="p" href="man.dnssec-checkds.html">Prev</a>�</td>
2609df5222cfcceb51ec536b2e3173b7227a232avboxsync<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-dsfromkey.html">Next</a>
dee9595a04fb1bd1908a48bd602fa1ed0b6967f9vboxsync<a name="man.dnssec-coverage"></a><div class="titlepage"></div>
2609df5222cfcceb51ec536b2e3173b7227a232avboxsync — checks future DNSKEY coverage for a zone
2609df5222cfcceb51ec536b2e3173b7227a232avboxsync [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
2609df5222cfcceb51ec536b2e3173b7227a232avboxsync [<code class="option">-l <em class="replaceable"><code>length</code></em></code>]
2609df5222cfcceb51ec536b2e3173b7227a232avboxsync [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync [<code class="option">-d <em class="replaceable"><code>DNSKEY TTL</code></em></code>]
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync [<code class="option">-m <em class="replaceable"><code>max TTL</code></em></code>]
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync [<code class="option">-r <em class="replaceable"><code>interval</code></em></code>]
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync [<code class="option">-c <em class="replaceable"><code>compilezone path</code></em></code>]
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync <p><span class="command"><strong>dnssec-coverage</strong></span>
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync verifies that the DNSSEC keys for a given zone or a set of zones
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync have timing metadata set properly to ensure no future lapses in DNSSEC
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync If <code class="option">zone</code> is specified, then keys found in
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync the key repository matching that zone are scanned, and an ordered
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync list is generated of the events scheduled for that key (i.e.,
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync publication, activation, inactivation, deletion). The list of
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync events is walked in order of occurrence. Warnings are generated
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync if any event is scheduled which could cause the zone to enter a
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync state in which validation failures might occur: for example, if
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync the number of published or active keys for a given algorithm drops
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync to zero, or if a key is deleted from the zone too soon after a new
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync key is rolled, and cached data signed by the prior key has not had
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync time to expire from resolver caches.
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync If <code class="option">zone</code> is not specified, then all keys in the
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync key repository will be scanned, and all zones for which there are
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync keys will be analyzed. (Note: This method of reporting is only
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync accurate if all the zones that have keys in a given repository
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync share the same TTL parameters.)
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync <div class="variablelist"><dl class="variablelist">
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync Sets the directory in which keys can be found. Defaults to the
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync current working directory.
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync If a <code class="option">file</code> is specified, then the zone is
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync read from that file; the largest TTL and the DNSKEY TTL are
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync determined directly from the zone data, and the
ddd5bf03356cc0515b0f42ed9048a6364e7eb1e2vboxsync <code class="option">-m</code> and <code class="option">-d</code> options do
ddd5bf03356cc0515b0f42ed9048a6364e7eb1e2vboxsync not need to be specified on the command line.
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync<dt><span class="term">-l <em class="replaceable"><code>duration</code></em></span></dt>
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync The length of time to check for DNSSEC coverage. Key events
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync scheduled further into the future than <code class="option">duration</code>
e0e0c19eefceaf5d4ec40f9466b58a771f50e799vboxsync will be ignored, and assumed to be correct.
6cc021fd3b938167e394bcc965950905e190b53cvboxsync The value of <code class="option">duration</code> can be set in seconds,
9ca6b5869be6c269085ef2294ac0863be7749346vboxsync or in larger units of time by adding a suffix: 'mi' for minutes,
81b3101ea5e60964f67c97185bbd43dbf75c5ab5vboxsync 'h' for hours, 'd' for days, 'w' for weeks, 'mo' for months,
81b3101ea5e60964f67c97185bbd43dbf75c5ab5vboxsync 'y' for years.
62ed6bd79f908178d0f43e03af813be1eb9d0f87vboxsync<dt><span class="term">-m <em class="replaceable"><code>maximum TTL</code></em></span></dt>
7908c1b917ec64d28d80a506f7a1bc524cd2f212vboxsync Sets the value to be used as the maximum TTL for the zone or
7908c1b917ec64d28d80a506f7a1bc524cd2f212vboxsync zones being analyzed when determining whether there is a
7908c1b917ec64d28d80a506f7a1bc524cd2f212vboxsync possibility of validation failure. When a zone-signing key is
7908c1b917ec64d28d80a506f7a1bc524cd2f212vboxsync deactivated, there must be enough time for the record in the
7908c1b917ec64d28d80a506f7a1bc524cd2f212vboxsync zone with the longest TTL to have expired from resolver caches
f0b06b8e4de2a0d9ddb10ac0a30d68fafd73d8c1vboxsync before that key can be purged from the DNSKEY RRset. If that
7908c1b917ec64d28d80a506f7a1bc524cd2f212vboxsync condition does not apply, a warning will be generated.
7908c1b917ec64d28d80a506f7a1bc524cd2f212vboxsync The length of the TTL can be set in seconds, or in larger units
7908c1b917ec64d28d80a506f7a1bc524cd2f212vboxsync of time by adding a suffix: 'mi' for minutes, 'h' for hours,
f0b06b8e4de2a0d9ddb10ac0a30d68fafd73d8c1vboxsync 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
f0b06b8e4de2a0d9ddb10ac0a30d68fafd73d8c1vboxsync This option is not necessary if the <code class="option">-f</code> has
f0b06b8e4de2a0d9ddb10ac0a30d68fafd73d8c1vboxsync been used to specify a zone file. If <code class="option">-f</code> has
7908c1b917ec64d28d80a506f7a1bc524cd2f212vboxsync been specified, this option may still be used; it will override
7908c1b917ec64d28d80a506f7a1bc524cd2f212vboxsync the value found in the file.
f0b06b8e4de2a0d9ddb10ac0a30d68fafd73d8c1vboxsync If this option is not used and the maximum TTL cannot be retrieved
7908c1b917ec64d28d80a506f7a1bc524cd2f212vboxsync from a zone file, a warning is generated and a default value of
7908c1b917ec64d28d80a506f7a1bc524cd2f212vboxsync 1 week is used.
7908c1b917ec64d28d80a506f7a1bc524cd2f212vboxsync<dt><span class="term">-d <em class="replaceable"><code>DNSKEY TTL</code></em></span></dt>
7908c1b917ec64d28d80a506f7a1bc524cd2f212vboxsync Sets the value to be used as the DNSKEY TTL for the zone or
7908c1b917ec64d28d80a506f7a1bc524cd2f212vboxsync zones being analyzed when determining whether there is a
7908c1b917ec64d28d80a506f7a1bc524cd2f212vboxsync possibility of validation failure. When a key is rolled (that
7908c1b917ec64d28d80a506f7a1bc524cd2f212vboxsync is, replaced with a new key), there must be enough time for the
7908c1b917ec64d28d80a506f7a1bc524cd2f212vboxsync old DNSKEY RRset to have expired from resolver caches before
7908c1b917ec64d28d80a506f7a1bc524cd2f212vboxsync the new key is activated and begins generating signatures. If
4a90abf7472a436c6951fd92417018a6890a69a7vboxsync that condition does not apply, a warning will be generated.
81b3101ea5e60964f67c97185bbd43dbf75c5ab5vboxsync The length of the TTL can be set in seconds, or in larger units
81b3101ea5e60964f67c97185bbd43dbf75c5ab5vboxsync of time by adding a suffix: 'mi' for minutes, 'h' for hours,
81b3101ea5e60964f67c97185bbd43dbf75c5ab5vboxsync 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
a076b35761e36233a2a3ba16f77c77d7849170cavboxsync This option is not necessary if <code class="option">-f</code> has
f75c063f235769c3627d3ddc3500fd5844164505vboxsync been used to specify a zone file from which the TTL
f75c063f235769c3627d3ddc3500fd5844164505vboxsync of the DNSKEY RRset can be read, or if a default key TTL was
3a45119099f0df5230e8304145168aa5e2a3f1a1vboxsync set using ith the <code class="option">-L</code> to
3a45119099f0df5230e8304145168aa5e2a3f1a1vboxsync <span class="command"><strong>dnssec-keygen</strong></span>. If either of those is true,
3a45119099f0df5230e8304145168aa5e2a3f1a1vboxsync this option may still be used; it will override the values
3a45119099f0df5230e8304145168aa5e2a3f1a1vboxsync found in the zone file or the key file.
6902a98267d5180fb081cb5273751d0a628bf04dvboxsync If this option is not used and the key TTL cannot be retrieved
3a45119099f0df5230e8304145168aa5e2a3f1a1vboxsync from the zone file or the key file, then a warning is generated
66a94fee6b0acc21c078369f49d97020cc03ab11vboxsync and a default value of 1 day is used.
3904a969d57a5bb3cc5136c75ec805b66f8660dcvboxsync<dt><span class="term">-r <em class="replaceable"><code>resign interval</code></em></span></dt>
3904a969d57a5bb3cc5136c75ec805b66f8660dcvboxsync Sets the value to be used as the resign interval for the zone
3904a969d57a5bb3cc5136c75ec805b66f8660dcvboxsync or zones being analyzed when determining whether there is a
3904a969d57a5bb3cc5136c75ec805b66f8660dcvboxsync possibility of validation failure. This value defaults to
3904a969d57a5bb3cc5136c75ec805b66f8660dcvboxsync 22.5 days, which is also the default in
a076b35761e36233a2a3ba16f77c77d7849170cavboxsync <span class="command"><strong>named</strong></span>. However, if it has been changed
2609df5222cfcceb51ec536b2e3173b7227a232avboxsync by the <code class="option">sig-validity-interval</code> option in
2609df5222cfcceb51ec536b2e3173b7227a232avboxsync <code class="filename">named.conf</code>, then it should also be
4a90abf7472a436c6951fd92417018a6890a69a7vboxsync changed here.
e85b92d4df013df97a72864a412eb94eb3f70acevboxsync The length of the interval can be set in seconds, or in larger
f0b06b8e4de2a0d9ddb10ac0a30d68fafd73d8c1vboxsync units of time by adding a suffix: 'mi' for minutes, 'h' for hours,
f0b06b8e4de2a0d9ddb10ac0a30d68fafd73d8c1vboxsync 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
f0b06b8e4de2a0d9ddb10ac0a30d68fafd73d8c1vboxsync Only check KSK coverage; ignore ZSK events. Cannot be
f0b06b8e4de2a0d9ddb10ac0a30d68fafd73d8c1vboxsync Only check ZSK coverage; ignore KSK events. Cannot be
f0b06b8e4de2a0d9ddb10ac0a30d68fafd73d8c1vboxsync<dt><span class="term">-c <em class="replaceable"><code>compilezone path</code></em></span></dt>
f0b06b8e4de2a0d9ddb10ac0a30d68fafd73d8c1vboxsync Specifies a path to a <span class="command"><strong>named-compilezone</strong></span> binary.
f0b06b8e4de2a0d9ddb10ac0a30d68fafd73d8c1vboxsync Used for testing.
f0b06b8e4de2a0d9ddb10ac0a30d68fafd73d8c1vboxsync <span class="refentrytitle">dnssec-checkds</span>(8)
f0b06b8e4de2a0d9ddb10ac0a30d68fafd73d8c1vboxsync <span class="refentrytitle">dnssec-dsfromkey</span>(8)
f0b06b8e4de2a0d9ddb10ac0a30d68fafd73d8c1vboxsync <span class="refentrytitle">dnssec-keygen</span>(8)
f0b06b8e4de2a0d9ddb10ac0a30d68fafd73d8c1vboxsync <span class="refentrytitle">dnssec-signzone</span>(8)
f0b06b8e4de2a0d9ddb10ac0a30d68fafd73d8c1vboxsync<a accesskey="p" href="man.dnssec-checkds.html">Prev</a>�</td>
f0b06b8e4de2a0d9ddb10ac0a30d68fafd73d8c1vboxsync<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
f0b06b8e4de2a0d9ddb10ac0a30d68fafd73d8c1vboxsync<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-dsfromkey.html">Next</a>
f0b06b8e4de2a0d9ddb10ac0a30d68fafd73d8c1vboxsync<span class="application">dnssec-checkds</span>�</td>
f0b06b8e4de2a0d9ddb10ac0a30d68fafd73d8c1vboxsync<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
f0b06b8e4de2a0d9ddb10ac0a30d68fafd73d8c1vboxsync<td width="40%" align="right" valign="top">�<span class="application">dnssec-dsfromkey</span>
f0b06b8e4de2a0d9ddb10ac0a30d68fafd73d8c1vboxsync<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.2 (Extended Support Version)</p>