man.dnssec-coverage.html revision 6ea2385360e9e2167e65f9286447da9eea189457
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen - Copyright (C) 2000-2003 Internet Software Consortium.
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen - Permission to use, copy, modify, and/or distribute this software for any
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen - purpose with or without fee is hereby granted, provided that the above
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen - copyright notice and this permission notice appear in all copies.
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen - PERFORMANCE OF THIS SOFTWARE.
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen<link rel="prev" href="man.dnssec-checkds.html" title="dnssec-checkds">
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen<link rel="next" href="man.dnssec-dsfromkey.html" title="dnssec-dsfromkey">
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen<table width="100%" summary="Navigation header">
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen<tr><th colspan="3" align="center"><span class="application">dnssec-coverage</span></th></tr>
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen<a accesskey="p" href="man.dnssec-checkds.html">Prev</a>�</td>
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen<th width="60%" align="center">Manual pages</th>
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-dsfromkey.html">Next</a>
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen<a name="man.dnssec-coverage"></a><div class="titlepage"></div>
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen<p><span class="application">dnssec-coverage</span> — checks future DNSKEY coverage for a zone</p>
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen<div class="cmdsynopsis"><p><code class="command">dnssec-coverage</code> [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>length</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>DNSKEY TTL</code></em></code>] [<code class="option">-m <em class="replaceable"><code>max TTL</code></em></code>] [<code class="option">-r <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-c <em class="replaceable"><code>compilezone path</code></em></code>] [<code class="option">-k</code>] [<code class="option">-z</code>] [zone]</p></div>
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen<p><span><strong class="command">dnssec-coverage</strong></span>
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen verifies that the DNSSEC keys for a given zone or a set of zones
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen have timing metadata set properly to ensure no future lapses in DNSSEC
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen If <code class="option">zone</code> is specified, then keys found in
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen the key repository matching that zone are scanned, and an ordered
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen list is generated of the events scheduled for that key (i.e.,
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen publication, activation, inactivation, deletion). The list of
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen events is walked in order of occurrence. Warnings are generated
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen if any event is scheduled which could cause the zone to enter a
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen state in which validation failures might occur: for example, if
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen the number of published or active keys for a given algorithm drops
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen to zero, or if a key is deleted from the zone too soon after a new
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen key is rolled, and cached data signed by the prior key has not had
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen time to expire from resolver caches.
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen If <code class="option">zone</code> is not specified, then all keys in the
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen key repository will be scanned, and all zones for which there are
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen keys will be analyzed. (Note: This method of reporting is only
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen accurate if all the zones that have keys in a given repository
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen share the same TTL parameters.)
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen Sets the directory in which keys can be found. Defaults to the
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen current working directory.
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen If a <code class="option">file</code> is specified, then the zone is
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen read from that file; the largest TTL and the DNSKEY TTL are
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen determined directly from the zone data, and the
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen <code class="option">-m</code> and <code class="option">-d</code> options do
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen not need to be specified on the command line.
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen<dt><span class="term">-l <em class="replaceable"><code>duration</code></em></span></dt>
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen The length of time to check for DNSSEC coverage. Key events
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen scheduled further into the future than <code class="option">duration</code>
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen will be ignored, and assumed to be correct.
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen The value of <code class="option">duration</code> can be set in seconds,
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen or in larger units of time by adding a suffix: 'mi' for minutes,
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen 'h' for hours, 'd' for days, 'w' for weeks, 'mo' for months,
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen 'y' for years.
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen<dt><span class="term">-m <em class="replaceable"><code>maximum TTL</code></em></span></dt>
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen Sets the value to be used as the maximum TTL for the zone or
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen zones being analyzed when determining whether there is a
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen possibility of validation failure. When a zone-signing key is
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen deactivated, there must be enough time for the record in the
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen zone with the longest TTL to have expired from resolver caches
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen before that key can be purged from the DNSKEY RRset. If that
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen condition does not apply, a warning will be generated.
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen The length of the TTL can be set in seconds, or in larger units
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen of time by adding a suffix: 'mi' for minutes, 'h' for hours,
cfa8a04466cd46bdc422bd9eba8e6794758d677bTimo Sirainen 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen This option is mandatory unless the <code class="option">-f</code> has
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen been used to specify a zone file. (If <code class="option">-f</code> has
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen been specified, this option may still be used; it will overrde
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen the value found in the file.)
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen<dt><span class="term">-d <em class="replaceable"><code>DNSKEY TTL</code></em></span></dt>
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen Sets the value to be used as the DNSKEY TTL for the zone or
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen zones being analyzed when determining whether there is a
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen possibility of validation failure. When a key is rolled (that
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen is, replaced with a new key), there must be enough time
cfa8a04466cd46bdc422bd9eba8e6794758d677bTimo Sirainen for the old DNSKEY RRset to have expired from resolver caches
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen before the new key is activated and begins generating
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen signatures. If that condition does not apply, a warning
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen will be generated.
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen The length of the TTL can be set in seconds, or in larger units
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen of time by adding a suffix: 'mi' for minutes, 'h' for hours,
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen This option is mandatory unless the <code class="option">-f</code> has
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen been used to specify a zone file, or a default key TTL was
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen set with the <code class="option">-L</code> to
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen <span><strong class="command">dnssec-keygen</strong></span>. (If either of those is true,
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen this option may still be used; it will overrde the value found
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen in the zone or key file.)
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen<dt><span class="term">-r <em class="replaceable"><code>resign interval</code></em></span></dt>
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen Sets the value to be used as the resign interval for the zone
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen or zones being analyzed when determining whether there is a
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen possibility of validation failure. This value defaults to
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen 22.5 days, which is also the default in
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen <span><strong class="command">named</strong></span>. However, if it has been changed
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen by the <code class="option">sig-validity-interval</code> option in
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen <code class="filename">named.conf</code>, then it should also be
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen changed here.
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen The length of the interval can be set in seconds, or in larger
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen units of time by adding a suffix: 'mi' for minutes, 'h' for hours,
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen Only check KSK coverage; ignore ZSK events. Cannot be
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen Only check ZSK coverage; ignore KSK events. Cannot be
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen<dt><span class="term">-c <em class="replaceable"><code>compilezone path</code></em></span></dt>
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen Specifies a path to a <span><strong class="command">named-compilezone</strong></span> binary.
d9e404180ff26dbbaea68534a5f176765022b76bTimo Sirainen Used for testing.
cfa8a04466cd46bdc422bd9eba8e6794758d677bTimo Sirainen <span class="citerefentry"><span class="refentrytitle">dnssec-checkds</span>(8)</span>,