man.dnssec-coverage.html revision 7e71f05d8643aca84914437c900cb716444507e4
b7663b97a437dc089ac7a1a9ebd42e0c372a48b6gstein - Copyright (C) 2000-2015 Internet Systems Consortium, Inc. ("ISC")
2a6c49cfaef5979a5a06098f3ce987cd76769409manoj - This Source Code Form is subject to the terms of the Mozilla Public
2a6c49cfaef5979a5a06098f3ce987cd76769409manoj - License, v. 2.0. If a copy of the MPL was not distributed with this
2deb319e6b3de239f45c16a3e9e836d44f1f7108rbb - file, You can obtain one at http://mozilla.org/MPL/2.0/.
2a6c49cfaef5979a5a06098f3ce987cd76769409manoj<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
91a71946d0fb28c0866139edef3dd59f36ba5b9cstoddard<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
91a71946d0fb28c0866139edef3dd59f36ba5b9cstoddard<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
91a71946d0fb28c0866139edef3dd59f36ba5b9cstoddard<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
91a71946d0fb28c0866139edef3dd59f36ba5b9cstoddard<link rel="prev" href="man.dnssec-checkds.html" title="dnssec-checkds">
91a71946d0fb28c0866139edef3dd59f36ba5b9cstoddard<link rel="next" href="man.dnssec-dsfromkey.html" title="dnssec-dsfromkey">
bd929c73ef04789b7183b840d8db6e01d03a4d86rbb<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
632b0b53511f3bb9c32aa2869fbc73ee35081b38rbb<tr><th colspan="3" align="center"><span class="application">dnssec-coverage</span></th></tr>
bd929c73ef04789b7183b840d8db6e01d03a4d86rbb<a accesskey="p" href="man.dnssec-checkds.html">Prev</a>�</td>
b7663b97a437dc089ac7a1a9ebd42e0c372a48b6gstein<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-dsfromkey.html">Next</a>
2a6c49cfaef5979a5a06098f3ce987cd76769409manoj<a name="man.dnssec-coverage"></a><div class="titlepage"></div>
85cbdc16ac57fa68ce1358a308269abcd417f4d9stoddard<p><span class="application">dnssec-coverage</span> — checks future DNSKEY coverage for a zone</p>
d208bda4a893cc81ed5d3ed1cdd7d706e012bd42stoddard<div class="cmdsynopsis"><p><code class="command">dnssec-coverage</code> [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>length</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>DNSKEY TTL</code></em></code>] [<code class="option">-m <em class="replaceable"><code>max TTL</code></em></code>] [<code class="option">-r <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-c <em class="replaceable"><code>compilezone path</code></em></code>] [<code class="option">-k</code>] [<code class="option">-z</code>] [zone...]</p></div>
75960f20f88dad6bc67892c711c429946063d133stoddard<p><span class="command"><strong>dnssec-coverage</strong></span>
75960f20f88dad6bc67892c711c429946063d133stoddard verifies that the DNSSEC keys for a given zone or a set of zones
75960f20f88dad6bc67892c711c429946063d133stoddard have timing metadata set properly to ensure no future lapses in DNSSEC
10b386767f6c87b45937244371cb751f0b454d16wrowe If <code class="option">zone</code> is specified, then keys found in
10b386767f6c87b45937244371cb751f0b454d16wrowe the key repository matching that zone are scanned, and an ordered
10b386767f6c87b45937244371cb751f0b454d16wrowe list is generated of the events scheduled for that key (i.e.,
10b386767f6c87b45937244371cb751f0b454d16wrowe publication, activation, inactivation, deletion). The list of
10b386767f6c87b45937244371cb751f0b454d16wrowe events is walked in order of occurrence. Warnings are generated
10b386767f6c87b45937244371cb751f0b454d16wrowe if any event is scheduled which could cause the zone to enter a
10b386767f6c87b45937244371cb751f0b454d16wrowe state in which validation failures might occur: for example, if
10b386767f6c87b45937244371cb751f0b454d16wrowe the number of published or active keys for a given algorithm drops
10b386767f6c87b45937244371cb751f0b454d16wrowe to zero, or if a key is deleted from the zone too soon after a new
10b386767f6c87b45937244371cb751f0b454d16wrowe key is rolled, and cached data signed by the prior key has not had
10b386767f6c87b45937244371cb751f0b454d16wrowe time to expire from resolver caches.
f6a6245816cd866361da8c576b1f47c7a54b6610fanf If <code class="option">zone</code> is not specified, then all keys in the
db3ccce11afac4fc1d4f51a65424412f7480c46cgstein key repository will be scanned, and all zones for which there are
db3ccce11afac4fc1d4f51a65424412f7480c46cgstein keys will be analyzed. (Note: This method of reporting is only
2a6c49cfaef5979a5a06098f3ce987cd76769409manoj accurate if all the zones that have keys in a given repository
8bed76428f56e5c643174a2d6807c3f18016af5cbjh share the same TTL parameters.)
cfc020d6d6fc9b31d8945915e65a8787a796eb73stoddard<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
f824925ac58ff729289c017235eeb3bdd21ec3a2stoddard Sets the directory in which keys can be found. Defaults to the
f824925ac58ff729289c017235eeb3bdd21ec3a2stoddard current working directory.
f824925ac58ff729289c017235eeb3bdd21ec3a2stoddard<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
2aae6faee508221efbeaba5547ca79b7a20ef047stoddard If a <code class="option">file</code> is specified, then the zone is
10b386767f6c87b45937244371cb751f0b454d16wrowe read from that file; the largest TTL and the DNSKEY TTL are
10b386767f6c87b45937244371cb751f0b454d16wrowe determined directly from the zone data, and the
10b386767f6c87b45937244371cb751f0b454d16wrowe <code class="option">-m</code> and <code class="option">-d</code> options do
10b386767f6c87b45937244371cb751f0b454d16wrowe not need to be specified on the command line.
10b386767f6c87b45937244371cb751f0b454d16wrowe<dt><span class="term">-l <em class="replaceable"><code>duration</code></em></span></dt>
75960f20f88dad6bc67892c711c429946063d133stoddard The length of time to check for DNSSEC coverage. Key events
a5ed555df952c85bc1b179f5981e8a6c54ba16e6stoddard scheduled further into the future than <code class="option">duration</code>
a5ed555df952c85bc1b179f5981e8a6c54ba16e6stoddard will be ignored, and assumed to be correct.
a5ed555df952c85bc1b179f5981e8a6c54ba16e6stoddard The value of <code class="option">duration</code> can be set in seconds,
56ca30c968906053ae61acb218420667bb58d996rbb or in larger units of time by adding a suffix: 'mi' for minutes,
56ca30c968906053ae61acb218420667bb58d996rbb 'h' for hours, 'd' for days, 'w' for weeks, 'mo' for months,
56ca30c968906053ae61acb218420667bb58d996rbb 'y' for years.
70f6f32765cfaadd6da8de6f0fea97ddd72d8fadmanoj<dt><span class="term">-m <em class="replaceable"><code>maximum TTL</code></em></span></dt>
0bff2f28ef945280c17099c142126178a78e1e54manoj Sets the value to be used as the maximum TTL for the zone or
0bff2f28ef945280c17099c142126178a78e1e54manoj zones being analyzed when determining whether there is a
0bff2f28ef945280c17099c142126178a78e1e54manoj possibility of validation failure. When a zone-signing key is
1e585ba09ea32272e63c4c39c35491e975d21d98stoddard deactivated, there must be enough time for the record in the
1e585ba09ea32272e63c4c39c35491e975d21d98stoddard zone with the longest TTL to have expired from resolver caches
1e585ba09ea32272e63c4c39c35491e975d21d98stoddard before that key can be purged from the DNSKEY RRset. If that
1e585ba09ea32272e63c4c39c35491e975d21d98stoddard condition does not apply, a warning will be generated.
1e585ba09ea32272e63c4c39c35491e975d21d98stoddard The length of the TTL can be set in seconds, or in larger units
9c09943bad734ebd5c7cc10bd6d63b75c4c6e056stoddard of time by adding a suffix: 'mi' for minutes, 'h' for hours,
9c09943bad734ebd5c7cc10bd6d63b75c4c6e056stoddard 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
0bff2f28ef945280c17099c142126178a78e1e54manoj This option is not necessary if the <code class="option">-f</code> has
0bff2f28ef945280c17099c142126178a78e1e54manoj been used to specify a zone file. If <code class="option">-f</code> has
9c09943bad734ebd5c7cc10bd6d63b75c4c6e056stoddard been specified, this option may still be used; it will override
75960f20f88dad6bc67892c711c429946063d133stoddard the value found in the file.
aa1faea36e4ae357bc603a2337b6adc54f5daec1manoj If this option is not used and the maximum TTL cannot be retrieved
f03d292915be9977eaf74e9be7b0404aec226f84manoj from a zone file, a warning is generated and a default value of
f03d292915be9977eaf74e9be7b0404aec226f84manoj 1 week is used.
bd929c73ef04789b7183b840d8db6e01d03a4d86rbb<dt><span class="term">-d <em class="replaceable"><code>DNSKEY TTL</code></em></span></dt>
302dc1f7b3feee23a91ad8f3cf3cb2edd95a557bmanoj Sets the value to be used as the DNSKEY TTL for the zone or
302dc1f7b3feee23a91ad8f3cf3cb2edd95a557bmanoj zones being analyzed when determining whether there is a
302dc1f7b3feee23a91ad8f3cf3cb2edd95a557bmanoj possibility of validation failure. When a key is rolled (that
ff849e4163ed879288f0df15f78b6c9d278ec804fanf is, replaced with a new key), there must be enough time for the
ff849e4163ed879288f0df15f78b6c9d278ec804fanf old DNSKEY RRset to have expired from resolver caches before
ff849e4163ed879288f0df15f78b6c9d278ec804fanf the new key is activated and begins generating signatures. If
ff849e4163ed879288f0df15f78b6c9d278ec804fanf that condition does not apply, a warning will be generated.
df4a7c143b27b489dd2d865bb3f6668c8420b3a9fanf The length of the TTL can be set in seconds, or in larger units
c03566fa0156d3a1500a42e4fe539e3e0fc8a11dgstein of time by adding a suffix: 'mi' for minutes, 'h' for hours,
c03566fa0156d3a1500a42e4fe539e3e0fc8a11dgstein 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
c03566fa0156d3a1500a42e4fe539e3e0fc8a11dgstein This option is not necessary if <code class="option">-f</code> has
c03566fa0156d3a1500a42e4fe539e3e0fc8a11dgstein been used to specify a zone file from which the TTL
c03566fa0156d3a1500a42e4fe539e3e0fc8a11dgstein of the DNSKEY RRset can be read, or if a default key TTL was
18e4b2bda5bee4cc6452075bdb5514ea78e5840ftrawick <span class="command"><strong>dnssec-keygen</strong></span>. If either of those is true,
18e4b2bda5bee4cc6452075bdb5514ea78e5840ftrawick this option may still be used; it will override the values
db3ccce11afac4fc1d4f51a65424412f7480c46cgstein found in the zone file or the key file.
db3ccce11afac4fc1d4f51a65424412f7480c46cgstein If this option is not used and the key TTL cannot be retrieved
2a6c49cfaef5979a5a06098f3ce987cd76769409manoj from the zone file or the key file, then a warning is generated
2a6c49cfaef5979a5a06098f3ce987cd76769409manoj and a default value of 1 day is used.
d5defd5a0c5cdbaf74b85939484dc2b6c8317d19manoj<dt><span class="term">-r <em class="replaceable"><code>resign interval</code></em></span></dt>
2a6c49cfaef5979a5a06098f3ce987cd76769409manoj Sets the value to be used as the resign interval for the zone
2a6c49cfaef5979a5a06098f3ce987cd76769409manoj or zones being analyzed when determining whether there is a
2a6c49cfaef5979a5a06098f3ce987cd76769409manoj possibility of validation failure. This value defaults to
2a6c49cfaef5979a5a06098f3ce987cd76769409manoj 22.5 days, which is also the default in
0bff2f28ef945280c17099c142126178a78e1e54manoj <span class="command"><strong>named</strong></span>. However, if it has been changed
0bff2f28ef945280c17099c142126178a78e1e54manoj by the <code class="option">sig-validity-interval</code> option in
0bff2f28ef945280c17099c142126178a78e1e54manoj <code class="filename">named.conf</code>, then it should also be
d6b3cb141f0667101c1bca883ad15b383402c93bfielding changed here.
2a6c49cfaef5979a5a06098f3ce987cd76769409manoj The length of the interval can be set in seconds, or in larger
40a5b7189dbbb28e107bf008ee625f2f0142c2ccdgaudet units of time by adding a suffix: 'mi' for minutes, 'h' for hours,
2a6c49cfaef5979a5a06098f3ce987cd76769409manoj 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
2a6c49cfaef5979a5a06098f3ce987cd76769409manoj Only check KSK coverage; ignore ZSK events. Cannot be
f6a6245816cd866361da8c576b1f47c7a54b6610fanf Only check ZSK coverage; ignore KSK events. Cannot be
f6a6245816cd866361da8c576b1f47c7a54b6610fanf<dt><span class="term">-c <em class="replaceable"><code>compilezone path</code></em></span></dt>
2a6c49cfaef5979a5a06098f3ce987cd76769409manoj Specifies a path to a <span class="command"><strong>named-compilezone</strong></span> binary.
2a6c49cfaef5979a5a06098f3ce987cd76769409manoj Used for testing.
d6b3cb141f0667101c1bca883ad15b383402c93bfielding <span class="citerefentry"><span class="refentrytitle">dnssec-checkds</span>(8)</span>,
d6b3cb141f0667101c1bca883ad15b383402c93bfielding <span class="citerefentry"><span class="refentrytitle">dnssec-dsfromkey</span>(8)</span>,
2a6c49cfaef5979a5a06098f3ce987cd76769409manoj <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
670734c2ee137c587411795c6f82566c9d3729b7coar <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>
2a6c49cfaef5979a5a06098f3ce987cd76769409manoj<a accesskey="p" href="man.dnssec-checkds.html">Prev</a>�</td>
2a6c49cfaef5979a5a06098f3ce987cd76769409manoj<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
d6b3cb141f0667101c1bca883ad15b383402c93bfielding<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-dsfromkey.html">Next</a>