man.dnssec-coverage.html revision 78ec962d9828200d18cd0e41b7d6b9792a74923d
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
32098293b78922a5fbd10906afa28624820d3756Tinderbox User - Copyright (C) 2000-2003 Internet Software Consortium.
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User - Permission to use, copy, modify, and/or distribute this software for any
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User - purpose with or without fee is hereby granted, provided that the above
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User - copyright notice and this permission notice appear in all copies.
d6fa26d0adaec6c910115be34fe7a5a5f402c14fMark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - PERFORMANCE OF THIS SOFTWARE.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<!-- $Id$ -->
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="prev" href="man.dnssec-checkds.html" title="dnssec-checkds">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="next" href="man.dnssec-dsfromkey.html" title="dnssec-dsfromkey">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<table width="100%" summary="Navigation header">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<tr><th colspan="3" align="center"><span class="application">dnssec-coverage</span></th></tr>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<a accesskey="p" href="man.dnssec-checkds.html">Prev</a>�</td>
0b89eee6167201843c9a46b7e7c63cb1e4e09ba3Tinderbox User<th width="60%" align="center">Manual pages</th>
32098293b78922a5fbd10906afa28624820d3756Tinderbox User<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-dsfromkey.html">Next</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="man.dnssec-coverage"></a><div class="titlepage"></div>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<p><span class="application">dnssec-coverage</span> — checks future DNSKEY coverage for a zone</p>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<div class="cmdsynopsis"><p><code class="command">dnssec-coverage</code> [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>length</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>DNSKEY TTL</code></em></code>] [<code class="option">-m <em class="replaceable"><code>max TTL</code></em></code>] [<code class="option">-r <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-c <em class="replaceable"><code>compilezone path</code></em></code>] [<code class="option">-k</code>] [<code class="option">-z</code>] [zone]</p></div>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<p><span><strong class="command">dnssec-coverage</strong></span>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User verifies that the DNSSEC keys for a given zone or a set of zones
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein have timing metadata set properly to ensure no future lapses in DNSSEC
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User If <code class="option">zone</code> is specified, then keys found in
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User the key repository matching that zone are scanned, and an ordered
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User list is generated of the events scheduled for that key (i.e.,
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User publication, activation, inactivation, deletion). The list of
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User events is walked in order of occurrence. Warnings are generated
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if any event is scheduled which could cause the zone to enter a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein state in which validation failures might occur: for example, if
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the number of published or active keys for a given algorithm drops
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt to zero, or if a key is deleted from the zone too soon after a new
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key is rolled, and cached data signed by the prior key has not had
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User time to expire from resolver caches.
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User If <code class="option">zone</code> is not specified, then all keys in the
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User key repository will be scanned, and all zones for which there are
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein keys will be analyzed. (Note: This method of reporting is only
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User accurate if all the zones that have keys in a given repository
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User share the same TTL parameters.)
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Sets the directory in which keys can be found. Defaults to the
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User current working directory.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User If a <code class="option">file</code> is specified, then the zone is
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User read from that file; the largest TTL and the DNSKEY TTL are
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User determined directly from the zone data, and the
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User <code class="option">-m</code> and <code class="option">-d</code> options do
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User not need to be specified on the command line.
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<dt><span class="term">-l <em class="replaceable"><code>duration</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The length of time to check for DNSSEC coverage. Key events
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User scheduled further into the future than <code class="option">duration</code>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User will be ignored, and assumed to be correct.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The value of <code class="option">duration</code> can be set in seconds,
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater or in larger units of time by adding a suffix: 'mi' for minutes,
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User 'h' for hours, 'd' for days, 'w' for weeks, 'mo' for months,
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User 'y' for years.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="term">-m <em class="replaceable"><code>maximum TTL</code></em></span></dt>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User Sets the value to be used as the maximum TTL for the zone or
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User zones being analyzed when determining whether there is a
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User possibility of validation failure. When a zone-signing key is
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User deactivated, there must be enough time for the record in the
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User zone with the longest TTL to have expired from resolver caches
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User before that key can be purged from the DNSKEY RRset. If that
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater condition does not apply, a warning will be generated.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User The length of the TTL can be set in seconds, or in larger units
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User of time by adding a suffix: 'mi' for minutes, 'h' for hours,
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User This option is mandatory unless the <code class="option">-f</code> has
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User been used to specify a zone file. (If <code class="option">-f</code> has
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User been specified, this option may still be used; it will override
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User the value found in the file.)
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="term">-d <em class="replaceable"><code>DNSKEY TTL</code></em></span></dt>
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater Sets the value to be used as the DNSKEY TTL for the zone or
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User zones being analyzed when determining whether there is a
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User possibility of validation failure. When a key is rolled (that
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User is, replaced with a new key), there must be enough time
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt for the old DNSKEY RRset to have expired from resolver caches
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User before the new key is activated and begins generating
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User signatures. If that condition does not apply, a warning
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User will be generated.
260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User The length of the TTL can be set in seconds, or in larger units
260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User of time by adding a suffix: 'mi' for minutes, 'h' for hours,
260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User This option is mandatory unless the <code class="option">-f</code> has
983df82baf1d7d0b668c98cf45928a19f175c6e7Tinderbox User been used to specify a zone file, or a default key TTL was
260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User set with the <code class="option">-L</code> to
260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User <span><strong class="command">dnssec-keygen</strong></span>. (If either of those is true,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein this option may still be used; it will override the value found
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in the zone or key file.)
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<dt><span class="term">-r <em class="replaceable"><code>resign interval</code></em></span></dt>
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews Sets the value to be used as the resign interval for the zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein or zones being analyzed when determining whether there is a
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt possibility of validation failure. This value defaults to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 22.5 days, which is also the default in
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span><strong class="command">named</strong></span>. However, if it has been changed
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User by the <code class="option">sig-validity-interval</code> option in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">named.conf</code>, then it should also be
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt changed here.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The length of the interval can be set in seconds, or in larger
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein units of time by adding a suffix: 'mi' for minutes, 'h' for hours,
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User Only check KSK coverage; ignore ZSK events. Cannot be
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User Only check ZSK coverage; ignore KSK events. Cannot be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-c <em class="replaceable"><code>compilezone path</code></em></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Specifies a path to a <span><strong class="command">named-compilezone</strong></span> binary.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Used for testing.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span class="citerefentry"><span class="refentrytitle">dnssec-checkds</span>(8)</span>,
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User <span class="citerefentry"><span class="refentrytitle">dnssec-dsfromkey</span>(8)</span>,
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<p><span class="corpauthor">Internet Systems Consortium</span>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<a accesskey="p" href="man.dnssec-checkds.html">Prev</a>�</td>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-dsfromkey.html">Next</a>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<span class="application">dnssec-checkds</span>�</td>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="40%" align="right" valign="top">�<span class="application">dnssec-dsfromkey</span>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<p style="text-align: center;">BIND Version 9.11</p>